Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.
References:GSA_kwCzR0hTQS1taDJoLTZqOHEteDI0Ns4AAjZJ
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Codecov
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
|
npm:codecov
PURL:
pkg:npm/codecov
|
<= 3.6.1 | 3.6.2 | |
Affected Version RangesAll affected versions1.0.0, 1.0.1, 2.0.0, 2.0.1, 2.0.2, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.5.0, 3.6.0, 3.6.1 All unaffected versions3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.7.0, 3.7.1, 3.7.2, 3.8.0, 3.8.1, 3.8.2, 3.8.3 |
|||