-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how the 'cmd' string in the main function is constructed. The pre-patch code directly interpolated codecov.gcov_root, gcov_exec, and gcov_args into a shell command without sanitization. The commit diff shows these parameters were later wrapped with sanitize_arg() to neutralize dangerous characters, confirming these were the injection vectors. The CWE-88 classification and PoC demonstrating argument injection via gcov_args/gcov_exec further validate that the command construction in main() was the vulnerable code path.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| codecov | pip | < 2.0.16 | 2.0.16 |