CVE-2019-10800

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-88

Affected software

Vendor	Product	Versions
n/a	codecov	>= unspecified, < 2.0.16

References

https://github.com/codecov/codecov-python/commit/2a80aa434f74feb31242b6f213b75ce63ae97902Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-PYTHON-CODECOV-552149Exploit, Third Party Advisory
https://github.com/codecov/codecov-python/commit/2a80aa434f74feb31242b6f213b75ce63ae97902Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-PYTHON-CODECOV-552149Exploit, Third Party Advisory

Timeline

Published: Jul 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-108019.8enpeem through 2.2.0 allows execution of arbitrary commands. The "options.dir" argument is provided to the "exec" function without any sanit CVE-2019-108029.8giting version prior to 0.0.8 allows execution of arbritary commands. The first argument "repo" of function "pull()" is executed by the pack CVE-2019-108039.8push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated befo CVE-2019-108049.8serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" CVE-2019-108057.5valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions prov CVE-2019-108064.3vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into addi CVE-2019-108079.8Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments CVE-2019-108088.8utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of CVE-2019-10814.2An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who success CVE-2019-10827.8An elevation of privilege vulnerability exists in Microsoft Windows where a certain DLL, with Local Service privilege, is vulnerable to race CVE-2019-10837.5A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests, aka '.NET Denial of S CVE-2019-10846.5An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters.