# CVE-2020-15123: Codecov command injection in upload method

Source: https://junglewise.ai/threats/cve-2020-15123-codecov-command-injection-in-upload-method  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-07-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-15123 · Severity: low · CVSS 3.1 · Published 2020-07-20

Codecov is an npm package used in build pipelines to upload code coverage reports. The upload method contains a command injection vulnerability that allows attackers to execute arbitrary shell commands if they can control input passed to the function. While the reported severity is low due to the limited attack surface in typical CI/CD deployments, this could be exploited in custom integrations where untrusted input is processed.

Technologies: [codecov (npm)](https://junglewise.ai/threats/technologies/codecov). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-15123 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-15123 being exploited in the wild.

**How severe is CVE-2020-15123?** Low severity, with a CVSS score of 3.1, published 20 July 2020.

**Which products and versions are affected?** codecov (npm) SEMVER:introduced=0,fixed=3.7.1.

**Is there a fix for CVE-2020-15123?** Yes. codecov (npm): upgrade to 3.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-15123 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-15123?** Check whether you run codecov (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- codecov (npm): upgrade to 3.7.1 or later

  ```sh
  npm install codecov@3.7.1
  ```


## Technical details

The vulnerability is a command injection flaw (CWE-78) in the codecov npm package's upload method. The root cause is insufficient input sanitization: a previous fix (CVE-2020-7597) blocked the ampersand character (&) but failed to prevent injection via backticks (`), which can be used to execute arbitrary shell commands. An attacker who can control input passed to the upload method—such as environment variables or build parameters—can inject backticks to break out of the intended command and execute malicious code. The attack requires user interaction (deliberate integration of codecov into a build process) but no authentication. A patch is available in version 3.7.1.

## Affected products

- Codecov codecov < 3.7.1

## Identifiers

- CVE-2020-15123
- GHSA-xp63-6vf5-xf3v

## Timeline

- 2020-07-20: disclosed
- 2020-07-20: patched: Fixed in version 3.7.1

## References

- [https://github.com/codecov/codecov-node/security/advisories/GHSA-xp63-6vf5-xf3v](https://github.com/codecov/codecov-node/security/advisories/GHSA-xp63-6vf5-xf3v)

## Related threats

- [Codecov npm module command injection in gcov-args](https://junglewise.ai/threats/cve-2020-7596-codecov-npm-module-command-injection-in-gcov-args)
- [codecov NPM module command injection via gcov-root](https://junglewise.ai/threats/cve-2020-7597-codecov-npm-module-command-injection-via-gcov-root)