CVE-2020-7597

Name of the Vulnerable Software and Affected Versions codecov-node versions prior to 3.6.5

Description The issue allows remote attackers to execute arbitrary commands due to an incomplete fix of a previous problem. The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js.

Recommendations For versions prior to 3.6.5, update to version 3.6.5 or later to resolve the issue. As a temporary workaround, consider restricting the input provided to the gcov-root argument to prevent arbitrary command execution until a patch is applied.