-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized 'gcov-args' being incorporated into a system command via exec() in lib/codecov.js. Snyk's PoC demonstrates direct exploitation through this parameter, and the CWE-78 mapping confirms it's an OS command injection. The handleInput.upload method is the entry point for processing these arguments, making it the clear vulnerable function.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| codecov | npm | <= 3.6.1 | 3.6.2 |
JavaScriptJavaScriptOngoing coverage of React2Shell