Executive brief
Codecov is an npm package used in build pipelines to upload code coverage reports. The upload method contains a command injection vulnerability that allows attackers to execute arbitrary shell commands if they can control input passed to the function. While the reported severity is low due to the limited attack surface in typical CI/CD deployments, this could be exploited in custom integrations where untrusted input is processed.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the codecov npm package's upload method. The root cause is insufficient input sanitization: a previous fix (CVE-2020-7597) blocked the ampersand character (&) but failed to prevent injection via backticks (`), which can be used to execute arbitrary shell commands. An attacker who can control input passed to the upload method—such as environment variables or build parameters—can inject backticks to break out of the intended command and execute malicious code. The attack requires user interaction (deliberate integration of codecov into a build process) but no authentication. A patch is available in version 3.7.1.
Affected products
- Codecov codecov < 3.7.1
Timeline
- 2020-07-20: disclosed
- 2020-07-20: patched: Fixed in version 3.7.1