CVE-2019-10800: Vulnerability in codecov package
Summary
CVE-2019-10800: This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method. Affects codecov across 2 version ranges.
< 2.0.16
< 2a80aa434f74feb31242b6f213b75ce63ae97902
Fixed in 2a80aa434f74feb31242b6f213b75ce63ae97902. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The codecov package is a Python package available on PyPI. It is used for code coverage reporting and analysis. The package provides functionality to collect coverage data and generate reports. It is commonly used in software development projects to measure the effectiveness of test suites. However, the package is vulnerable to a security issue that can be exploited by attackers.
Vulnerability Detail
The vulnerability in the codecov package (before version 2.0.16) arises from a failure to sanitize gcov arguments before passing them to the popen method. This can lead to command injection attacks, where an attacker can execute arbitrary commands on the system running the vulnerable package. The impact of this vulnerability can be severe, as it allows unauthorized access and potential compromise of the system. It is crucial to address this vulnerability promptly to prevent any potential exploitation.
How To Fix
Latest published version: 2.1.13 as of 23 Oct 2026
pip install --upgrade "codecov==2.1.13"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2a80aa434f74feb31242b6f213b75ce63ae97902
This is the first release that contains the fix.
pip install --upgrade "codecov==2a80aa434f74feb31242b6f213b75ce63ae97902"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The codecov package (before version 2.0.16) is vulnerable to a command injection attack due to the lack of sanitization of gcov arguments. This vulnerability can lead to unauthorized access and compromise of the system. To mitigate the risk, it is crucial to update the package to version 2.0.16 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for codecov →
FAQ
The vulnerability allows attackers to execute arbitrary commands on the system running the vulnerable codecov package, potentially leading to unauthorized access and compromise of the system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
No specific workaround is mentioned for this vulnerability. It is recommended to update the codecov package to the fixed version (2.0.16 or later) as soon as possible.
There are no specific instances mentioned in the vulnerability details. However, given the severity of the vulnerability, it is crucial to address it promptly to prevent any potential exploitation.
You can find more information about this vulnerability in the advisory database of the Python Packaging Authority (PyPA). The source for this vulnerability is available at: https://github.com/pypa/advisory-database/blob/main/vulns/codecov/PYSEC-2022-238.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for codecov.
