CVE-2020-7596

Name of the Vulnerable Software and Affected Versions Codecov npm module versions prior to 3.6.2

Description The issue allows remote attackers to execute arbitrary commands via the gcov-args argument. This enables attackers to potentially gain control over the system.

Recommendations For versions prior to 3.6.2, update to version 3.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the gcov-args argument to minimize the risk of exploitation.