CVE-2020-15123: 
JavaScript vulnerability analysis and mitigation

CVE-2020-15123 is a command injection vulnerability discovered in the upload method of the codecov-node library. The vulnerability was disclosed on July 20, 2020. The vulnerability affects versions of codecov-node prior to v3.7.1. This vulnerability was a result of an incomplete fix for a previous similar vulnerability (CVE-2020-7597), which only blocked '&' character but still allowed command injection using other methods like backticks (GitHub Advisory).

The vulnerability exists in the upload method of the codecov-node library where command injection is possible through unsanitized input. While the previous fix (CVE-2020-7597) blocked the '&' character, attackers could still perform command injection using alternative methods such as backticks to bypass the sanitizer. The issue was detected using CodeQL query analysis (GitHub Advisory).

The vulnerability could allow remote attackers to execute arbitrary commands through the codecov-node library. Clients of the library might unknowingly write code containing this vulnerability, as they are unlikely to be aware of this security issue. However, the attack surface is considered low, particularly in standard use cases where the module is used directly in build pipelines rather than as a library in applications that might supply malicious input (GitHub Advisory).

The vulnerability was addressed by switching from execSync to execFileSync in the implementation, as demonstrated in PR #180. The fix involved changing how commands are executed to prevent command injection possibilities (GitHub PR).

The vulnerability was patched in version 3.7.1 of codecov-node. No workarounds were available, but the attack surface was considered low in standard use cases. Users should upgrade to version 3.7.1 or later to receive the security fix (GitHub Advisory).