Paper/Archive/CVE-2020-7623

CVE-2020-7623

snyk — jscover through 1.0.0 is vulnerable to Command Injection.

EPSS 4%CVSS 9.8

critical.is priorityof 100

47

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 89.4.894 × 2017.9 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument.

Affected

ProductAffectedFixed inSource

jscoverAll versions including 1.0.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/node-modules/jscover/blob/master/lib/jscover.js#L59%2C refsnyk.io/vuln/SNYK-JS-JSCOVER-564250