Codecov does not sanitize gcov arguments

MOYENNE 6.5CVE-2019-10800 · GHSA-h3qr-fjhm-jphw · PYSEC-2022-238 · Published 13/07/2022 · updated 17/06/2026

En bref

CVE-2019-10800 est une vulnérabilité MOYENNE (CVSS 6.5) touchant codecov, codecov-python (codecov).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.2%, plus élevée que 68.6% des vulnérabilités.
Correctif : mettre à jour vers 2.0.16 ou plus récent.

Package	Affected versions	Patched versions
codecov PyPI	`< 2.0.16`	`2.0.16`
codecov-python codecov	`< 2.0.16`	`2.0.16`

Description

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.

NVD description

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.

References

nvd.nist.gov/vuln/detail/CVE-2019-10800 · ADVISORY
codecov/codecov-python commit 2a80aa4 · WEB
GitHub Advisory GHSA-h3qr-fjhm-jphw · ADVISORY
codecov/codecov-python · PACKAGE
pypa/advisory-database · WEB
snyk.io/vuln/SNYK-PYTHON-CODECOV-552149 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free