CVE-2020-7597: Remote Code Execution in codecov NPM module
Summary
CVE-2020-7597: codecov NPM module allows remote attackers to execute arbitrary commands. Affects codecov versions < 3.6.5. Fixed in 3.6.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The codecov-node npm module is a package used for code coverage reporting in Node.js applications. It provides functionality to collect and process coverage data. The vulnerability in version 3.6.5 and earlier allows remote attackers to execute arbitrary commands. This vulnerability is a result of an incomplete fix for CVE-2020-7596. The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js.
Vulnerability Detail
The vulnerability in the codecov-node npm module allows remote attackers to execute arbitrary commands. By providing a malicious value as the gcov-root argument, an attacker can trigger the execution of arbitrary code. This can lead to unauthorized access, data breaches, and potential compromise of the affected system. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
Latest published version: 3.8.3 as of 22 Oct 2026
npm install codecov@3.8.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.5
This is the first release that contains the fix.
npm install codecov@3.6.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package as soon as possible.
Conclusion
The codecov-node npm module is vulnerable to remote code execution, allowing attackers to execute arbitrary commands. To mitigate this vulnerability, it is crucial to update the package to version 3.6.5 or later. No known workaround exists for this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for codecov →
FAQ
This vulnerability allows remote attackers to execute arbitrary commands, potentially leading to unauthorized access, data breaches, and compromise of the affected system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file to the playground without any signup.
No, there is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package.
The CVSS score of this vulnerability is 8.8, indicating a high severity.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-5q88-cjfq-g2mh/GHSA-5q88-cjfq-g2mh.json
References
Related vulnerabilities
Recent vulnerabilities recorded for codecov.
