CVE-2020-7623

CRITICAL

jscover < 1.0.0 - OS Command Injection via Source Argument

Title source: llm

jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument.

Core 2

Core References

Various Sources x_refsource_misc

Third Party Advisory x_refsource_misc

CVSS v3 9.8

EPSS 0.0350

EPSS Percentile 87.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-78

Status published

Products (2)

jscover_project/jscover < 1.0.0

npm/jscover 0npm

Published Apr 02, 2020

Tracked Since Feb 18, 2026