CVE-2020-7597

CVE-2020-7597 is a critical remote code execution vulnerability affecting the codecov-node npm module versions prior to 3.6.5. An attacker can execute arbitrary commands by injecting malicious input into the "gcov-root" argument, which is then processed by an insecure "exec" function. This vulnerability carries a CVSS score of 8.8 (High), indicating a severe risk with low attack complexity and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation, publicly available exploit code, or significant community discussion, this flaw represents an incomplete fix for a previous vulnerability and should be addressed promptly.