Security readout for executives and security teams
Plain-English summary
CVE-2019-10800 is a command injection issue in the codecov package before 2.0.16. If an attacker can influence gcov arguments used by the package, those arguments may reach popen without proper sanitization. The main business risk is exposure of sensitive data from CI or build environments.
Executive priority
Treat as a moderate-priority CI supply-chain hygiene issue. Prioritize remediation where codecov runs in pipelines with secrets, private source access, or broad contributor write access.
Technical view
The vulnerable code path passes unsanitized gcov arguments to popen in codecov before 2.0.16. The published CVSS 3.1 vector is network-reachable, low complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact.
Likely exposure
Exposure is most likely in repositories, CI jobs, or build systems using the Python codecov package before 2.0.16, especially where lower-privileged users can affect coverage tooling arguments or build configuration.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. The CVSS temporal vector includes proof-of-concept exploit maturity, but available evidence only supports potential exploitability, not confirmed in-the-wild abuse.
Researcher notes
Evidence identifies argument sanitization before popen as the root issue and points to a fixing commit. The bundle does not provide detailed affected version ranges beyond before 2.0.16, nor confirmed active exploitation.
Mitigation direction
- Upgrade codecov to version 2.0.16 or later.
- Check vendor advisories and dependency scanners for current remediation guidance.
- Restrict who can modify CI coverage configuration and build scripts.
- Avoid passing untrusted gcov arguments into coverage upload workflows.
- Review CI secrets exposure for projects using vulnerable versions.
Validation and detection
- Inventory dependency manifests and lockfiles for codecov versions before 2.0.16.
- Review CI pipelines for codecov usage with gcov options enabled.
- Confirm build contributors cannot control coverage arguments without review.
- Verify dependency scanning flags CVE-2019-10800 as remediated after upgrade.
- Check recent CI logs for unexpected codecov or gcov argument changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-10800 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- https://snyk.io/vuln/SNYK-PYTHON-CODECOV-552149CVE reference · x_refsource_MISC
- https://github.com/codecov/codecov-python/commit/2a80aa434f74feb31242b6f213b75ce63ae97902CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.