# CVE-2020-7597: codecov NPM module command injection via gcov-root

Source: https://junglewise.ai/threats/cve-2020-7597-codecov-npm-module-command-injection-via-gcov-root  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-02-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-7597 · Severity: low · CVSS 3.1 · Published 2020-02-19

The codecov NPM module is a utility used by development teams to upload code coverage reports to the Codecov service. A command injection vulnerability in the gcov-root argument handler allows authenticated attackers with local access to the build system to execute arbitrary commands with the privileges of the build process, potentially compromising CI/CD pipelines and introducing malicious code into production.

Technologies: [codecov (npm)](https://junglewise.ai/threats/technologies/codecov). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-7597 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-7597 being exploited in the wild.

**How severe is CVE-2020-7597?** Low severity, with a CVSS score of 3.1, published 19 February 2020.

**Which products and versions are affected?** codecov (npm) SEMVER:introduced=0,fixed=3.6.5.

**Is there a fix for CVE-2020-7597?** Yes. codecov (npm): upgrade to 3.6.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-7597 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-7597?** Check whether you run codecov (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- codecov (npm): upgrade to 3.6.5 or later

  ```sh
  npm install codecov@3.6.5
  ```


## Technical details

The codecov-node NPM module (versions before 3.6.5) contains a command injection vulnerability in lib/codecov.js where the gcov-root argument value is passed unsanitized to the exec function. An attacker can inject arbitrary shell commands by including shell metacharacters (e.g., "& touch exploit &") in the gcov-root parameter. The vulnerability requires authentication (a user must call the vulnerable function) but the attack vector is network-accessible as it can be exploited through module usage in CI/CD systems. This is an incomplete fix of CVE-2020-7596. The fix in version 3.6.5 properly escapes arguments before execution.

## Affected products

- codecov codecov before 3.6.5

## Identifiers

- CVE-2020-7597
- GHSA-5q88-cjfq-g2mh

## Timeline

- 2020-02-16: disclosed
- 2020-02-19: advisory
- 2020-02-19: patched: version 3.6.5 released

## References

- [https://github.com/codecov/codecov-node/commit/02cf13d8b93ac547b5b4c2cfe186b7d874fd234f](https://github.com/codecov/codecov-node/commit/02cf13d8b93ac547b5b4c2cfe186b7d874fd234f)
- [https://snyk.io/vuln/SNYK-JS-CODECOV-548879](https://snyk.io/vuln/SNYK-JS-CODECOV-548879)

## Related threats

- [Codecov npm module command injection in gcov-args](https://junglewise.ai/threats/cve-2020-7596-codecov-npm-module-command-injection-in-gcov-args)
- [Codecov command injection in upload method](https://junglewise.ai/threats/cve-2020-15123-codecov-command-injection-in-upload-method)