Skip to main content
cve.nowby Sazabi
← npm
npmPackage

codecov

3 known vulnerabilities (1 critical), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 1 critical
Registry
npm

Advisories 3

  • CVE-2020-15123Critical 9.3

    Command injection in codecov (npm package)

    Affected: fixed in 3.7.1.

  • codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root…

    Affected: fixed in 3.6.5.

  • Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.

    Affected: fixed in 3.6.2.