diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml
new file mode 100644
index 00000000..b15baf33
--- /dev/null
+++ b/.github/workflows/nodejs.yml
@@ -0,0 +1,26 @@
+name: Node CI
+
+on: [push]
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [8.x, 10.x, 12.x]
+
+    steps:
+    - uses: actions/checkout@v1
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v1
+      with:
+        node-version: ${{ matrix.node-version }}
+    - name: npm install, build, and test
+      run: |
+        npm install
+        npm run build --if-present
+        npm test
+      env:
+        CI: true
diff --git a/README.md b/README.md
index e7ce42ea..93a92763 100644
--- a/README.md
+++ b/README.md
@@ -106,3 +106,4 @@ nyc report --reporter=text-lcov > coverage.lcov
 - v3.4.0 Added Heroku CI support
 - v3.5.0 Added TeamCity support
 - v3.6.0 Added AWS CodeBuild and Semaphore2
+- v3.6.1 Fix for Semaphore
diff --git a/lib/codecov.js b/lib/codecov.js
index 516d1e91..0e850aa9 100644
--- a/lib/codecov.js
+++ b/lib/codecov.js
@@ -5,6 +5,7 @@ var urlgrey = require('urlgrey')
 var jsYaml = require('js-yaml')
 var walk = require('ignore-walk')
 var execSync = require('child_process').execSync
+var validator = require('validator')
 
 var detectProvider = require('./detect')
 
@@ -397,9 +398,9 @@ var upload = function(args, on_success, on_failure) {
           " -type f -name '*.gcno' " +
           gcg +
           ' -exec ' +
-          (args.options['gcov-exec'] || 'gcov') +
+          (validator.escape(args.options['gcov-exec']) || 'gcov') +
           ' ' +
-          (args.options['gcov-args'] || '') +
+          (validator.escape(args.options['gcov-args']) || '') +
           ' {} +'
       } else {
         // @TODO support for root
diff --git a/package-lock.json b/package-lock.json
index f0558995..c2d69de4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "codecov",
-  "version": "3.6.1",
+  "version": "3.6.2",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -6017,6 +6017,11 @@
         "spdx-expression-parse": "^3.0.0"
       }
     },
+    "validator": {
+      "version": "12.1.0",
+      "resolved": "https://registry.npmjs.org/validator/-/validator-12.1.0.tgz",
+      "integrity": "sha512-gIC2RBuFRi574Rb9vewGCJ7TCLxHXNx6EKthEgs+Iz0pYa9a9Te1VLG/bGLsAyGWrqR5FfR7tbFUI7FEF2LiGA=="
+    },
     "verror": {
       "version": "1.10.0",
       "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.0.tgz",
diff --git a/package.json b/package.json
index 6c8703ae..62278173 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "codecov",
-  "version": "3.6.1",
+  "version": "3.6.2",
   "description": "Uploading report to Codecov: https://codecov.io",
   "main": "index.js",
   "scripts": {
@@ -35,7 +35,8 @@
     "ignore-walk": "^3.0.1",
     "js-yaml": "^3.13.1",
     "teeny-request": "^3.11.3",
-    "urlgrey": "^0.4.4"
+    "urlgrey": "^0.4.4",
+    "validator": "^12.1.0"
   },
   "devDependencies": {
     "eslint": "^5.16.0",