High severity8.8NVD Advisory· Published Feb 17, 2020· Updated Jun 17, 2026

CVE-2020-7597

Description

codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
codecovnpm	< 3.6.5	3.6.5

Affected products

codecov-node/codecov-nodedescription
ghsa-coords
pkg:npm/codecov
Range: < 3.6.5
codecov/codecov
cpe:2.3:a:codecov:codecov:*:*:*:*:*:node.js:*:*
Range: <3.6.5

Patches

Vulnerability mechanics

References

github.com/codecov/codecov-node/commit/02cf13d8b93ac547b5b4c2cfe186b7d874fd234fnvdPatchWEB
snyk.io/vuln/SNYK-JS-CODECOV-548879nvdExploitPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-5q88-cjfq-g2mhghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-7597ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.002
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000