CVE-2020-15123: Command Injection in codecov (npm package)
Summary
CVE-2020-15123: Command injection in codecov (npm package). Affects codecov versions < 3.7.1. Fixed in 3.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The codecov package is an npm package used for code coverage reporting. It is commonly used in build pipelines to measure code coverage and generate reports. The package provides a upload method that allows users to upload coverage reports to the Codecov service. However, a command injection vulnerability has been discovered in the upload method, which could allow an attacker to execute arbitrary commands on the system running the vulnerable package.
Vulnerability Detail
The upload method in the codecov package is vulnerable to command injection. This means that an attacker can craft a malicious payload that, when passed to the upload method, will be executed as a command on the system. This can lead to various security risks, including remote code execution, data exfiltration, and privilege escalation. The vulnerability was initially reported as CVE-2020-7597, but the fix provided in that advisory was incomplete, allowing command injection using backticks instead of the blocked & character.
How To Fix
Latest published version: 3.8.3 as of 22 Oct 2026
npm install codecov@3.8.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.7.1
This is the first release that contains the fix.
npm install codecov@3.7.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround for this vulnerability. However, the attack surface is low in the standard use of codecov, where the module is used directly in a build pipeline. It is important to ensure that the codecov package is not used as a library in another application that may supply malicious input and perform command injection.
Conclusion
The codecov package is vulnerable to command injection, allowing an attacker to execute arbitrary commands on the system. This can lead to serious security risks. It is recommended to update the codecov package to version 3.7.1 to fix the vulnerability. For more information and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for codecov →
FAQ
The vulnerability allows an attacker to execute arbitrary commands on the system running the vulnerable codecov package. This can lead to various security risks, including remote code execution, data exfiltration, and privilege escalation.
Yes, this vulnerability has been assigned the CVE identifier CVE-2020-15123.
Yes, the vulnerability has been patched in version 3.7.1 of the codecov package. Users should update their codecov package to the latest version to fix the vulnerability.
There is no specific workaround for this vulnerability. However, the attack surface is low in the standard use of codecov, where the module is used directly in a build pipeline. It is important to ensure that the codecov package is not used as a library in another application that may supply malicious input and perform command injection.
You can find more information about this vulnerability in the CVE-2020-15123 advisory and the GitHub Security Advisory GHSA-xp63-6vf5-xf3v.
References
Related vulnerabilities
Recent vulnerabilities recorded for codecov.
