Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
22 vulnerabilities by renovatebot
CVE-2026-76233 (GCVE-0-2026-76233)
Vulnerability from nvd – Published: 2026-08-19 14:02 – Updated: 2026-08-19 14:45
VLAI
EPSS
VEX
Title
Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager
Summary
Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:44 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://github.com/renovatebot/renovate/commit/d2… | patch |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
39.53.0 , < 40.33.0
(semver)
Unaffected: 40.33.0 (semver) |
Date Public
2026-01-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76233",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:44:43.669994Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:45:31.617Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-xjr7-3c3g-m763"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "40.33.0",
"status": "affected",
"version": "39.53.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "40.33.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "astellingwerf"
}
],
"datePublic": "2026-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:13.767Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xjr7-3c3g-m763)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-xjr7-3c3g-m763"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/d29698e0131231652970f02765312769975e4d38"
},
{
"name": "VulnCheck Advisory: Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-gleam-manager"
}
],
"title": "Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76233",
"datePublished": "2026-08-19T14:02:13.767Z",
"dateReserved": "2026-08-19T11:36:02.574Z",
"dateUpdated": "2026-08-19T14:45:31.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76232 (GCVE-0-2026-76232)
Vulnerability from nvd – Published: 2026-08-19 14:02 – Updated: 2026-08-19 14:02
VLAI
EPSS
VEX
Title
Renovate 31.51.0 before 40.33.0 Command Injection via helmv3
Summary
Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate.
Severity
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://github.com/renovatebot/renovate/commit/f3… | patch |
| https://github.com/renovatebot/renovate/commit/a7… | patch |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
31.51.0 , < 40.33.0
(semver)
Unaffected: 40.33.0 (semver) |
Date Public
2026-01-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "40.33.0",
"status": "affected",
"version": "31.51.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "40.33.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "astellingwerf"
}
],
"datePublic": "2026-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:13.066Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3f44-xw83-3pmg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-3f44-xw83-3pmg"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/f372a68144a4d78c9f7f418168e4efe03336a432"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c"
},
{
"name": "VulnCheck Advisory: Renovate 31.51.0 before 40.33.0 Command Injection via helmv3",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3-2"
}
],
"title": "Renovate 31.51.0 before 40.33.0 Command Injection via helmv3",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76232",
"datePublished": "2026-08-19T14:02:13.066Z",
"dateReserved": "2026-08-19T11:36:02.574Z",
"dateUpdated": "2026-08-19T14:02:13.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76231 (GCVE-0-2026-76231)
Vulnerability from nvd – Published: 2026-08-19 14:02 – Updated: 2026-08-20 16:06
VLAI
EPSS
VEX
Title
Renovate 32.135.0 before 40.33.0 Command Injection via hermit
Summary
Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 16:06 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://github.com/renovatebot/renovate/commit/b6… | patch |
| https://github.com/renovatebot/renovate/commit/ea… | patch |
| https://github.com/renovatebot/renovate/commit/41… | patch |
| https://github.com/renovatebot/renovate/commit/a7… | patch |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
32.135.0 , < 40.33.0
(semver)
Unaffected: 40.33.0 (semver) |
Date Public
2026-01-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76231",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T16:06:40.739994Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T16:06:47.842Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "40.33.0",
"status": "affected",
"version": "32.135.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "40.33.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "astellingwerf"
}
],
"datePublic": "2026-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:12.328Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-36j9-mx87-2cff)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/b696abb3c2741508fbb4029f39153140a3722e1e"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/eaec10d7c8afadbdd783ac47bd2adbfab444d6df"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/41e8b99f86a6e2a56f80f7aa1a08a59d76f2358c"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c"
},
{
"name": "VulnCheck Advisory: Renovate 32.135.0 before 40.33.0 Command Injection via hermit",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-hermit"
}
],
"title": "Renovate 32.135.0 before 40.33.0 Command Injection via hermit",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76231",
"datePublished": "2026-08-19T14:02:12.328Z",
"dateReserved": "2026-08-19T11:36:02.573Z",
"dateUpdated": "2026-08-20T16:06:47.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76230 (GCVE-0-2026-76230)
Vulnerability from nvd – Published: 2026-08-19 14:02 – Updated: 2026-08-19 14:02
VLAI
EPSS
VEX
Title
Renovate 35.63.0 before 40.33.0 Command Injection via npm
Summary
Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate.
Severity
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://github.com/renovatebot/renovate/commit/01… | patch |
| https://github.com/renovatebot/renovate/commit/a7… | patch |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
35.63.0 , < 40.33.0
(semver)
Unaffected: 40.33.0 (semver) |
Date Public
2026-01-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "40.33.0",
"status": "affected",
"version": "35.63.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "40.33.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "astellingwerf"
}
],
"datePublic": "2026-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:11.620Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fr4j-65pv-gjjj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-fr4j-65pv-gjjj"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/012c0ac2fe32832e60a62bde405c0a241efd314c"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c"
},
{
"name": "VulnCheck Advisory: Renovate 35.63.0 before 40.33.0 Command Injection via npm",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-npm"
}
],
"title": "Renovate 35.63.0 before 40.33.0 Command Injection via npm",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76230",
"datePublished": "2026-08-19T14:02:11.620Z",
"dateReserved": "2026-08-19T11:36:02.573Z",
"dateUpdated": "2026-08-19T14:02:11.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76229 (GCVE-0-2026-76229)
Vulnerability from nvd – Published: 2026-08-19 14:02 – Updated: 2026-08-20 15:22
VLAI
EPSS
VEX
Title
Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize
Summary
Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yaml files with specially crafted chart names to execute arbitrary commands on the Renovate host machine.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:53 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://github.com/renovatebot/renovate/commit/cc… | patch |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
39.218.0 , < 40.33.0
(semver)
Unaffected: 40.33.0 (semver) |
Date Public
2026-01-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76229",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:53:35.631045Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:22:57.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "40.33.0",
"status": "affected",
"version": "39.218.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "40.33.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "astellingwerf"
}
],
"datePublic": "2026-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yaml files with specially crafted chart names to execute arbitrary commands on the Renovate host machine."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:10.888Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xv56-3wq5-9997)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-xv56-3wq5-9997"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/cc08c6e98f19e6258c5d3180c70c98e1be0b0d37"
},
{
"name": "VulnCheck Advisory: Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-arbitrary-command-injection-via-kustomize"
}
],
"title": "Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76229",
"datePublished": "2026-08-19T14:02:10.888Z",
"dateReserved": "2026-08-19T11:36:02.573Z",
"dateUpdated": "2026-08-20T15:22:57.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76228 (GCVE-0-2026-76228)
Vulnerability from nvd – Published: 2026-08-19 14:02 – Updated: 2026-08-19 14:48
VLAI
EPSS
VEX
Title
Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper
Summary
Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url <value>). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:47 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
32.124.0 , < 42.68.5
(semver)
Unaffected: 42.68.5 (semver) |
|
| renovatebot | renovate |
Affected:
0 , < 13.3.0
(semver)
Unaffected: 13.3.0 (semver) |
Date Public
2026-01-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76228",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:47:23.066070Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:48:41.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.68.5",
"status": "affected",
"version": "32.124.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.68.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.68.5",
"status": "affected",
"version": "32.124.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.68.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.68.5",
"status": "affected",
"version": "32.124.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.68.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.68.5",
"status": "affected",
"version": "32.124.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.68.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "y4rvin"
}
],
"datePublic": "2026-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions \u003e=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url \u003cvalue\u003e). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:10.197Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pfq2-hh62-7m96)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96"
},
{
"name": "VulnCheck Advisory: Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-remote-code-execution-via-gradle-wrapper"
}
],
"title": "Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76228",
"datePublished": "2026-08-19T14:02:10.197Z",
"dateReserved": "2026-08-19T11:36:02.573Z",
"dateUpdated": "2026-08-19T14:48:41.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76227 (GCVE-0-2026-76227)
Vulnerability from nvd – Published: 2026-08-19 14:02 – Updated: 2026-08-19 14:02
VLAI
EPSS
VEX
Title
Renovate 42.68.1 before 42.96.3 Environment Variable Exposure
Summary
Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.
Severity
5.5 (Medium)
CWE
- CWE-526 - Cleartext Storage of Sensitive Information in an Environment Variable
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
42.68.1 , < 42.96.3
(semver)
Unaffected: 42.96.3 (semver) |
|
| renovatebot | renovate |
Affected:
42.68.1 , < 43.4.4
(semver)
Unaffected: 43.4.4 (semver) |
|
| renovatebot | renovate |
Affected:
13.3.0 , < 13.6.0
(semver)
Unaffected: 13.6.0 (semver) |
Date Public
2026-02-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.96.3",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.96.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "43.4.4",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "43.4.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.96.3",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.96.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "43.4.4",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "43.4.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.96.3",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.96.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "43.4.4",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "43.4.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.96.3",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.96.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "43.4.4",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "43.4.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "viceice"
}
],
"datePublic": "2026-02-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker \u003e=13.3.0 \u003c13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-526",
"description": "Cleartext Storage of Sensitive Information in an Environment Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:09.384Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8wc6-vgrq-x6cf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-8wc6-vgrq-x6cf"
},
{
"name": "VulnCheck Advisory: Renovate 42.68.1 before 42.96.3 Environment Variable Exposure",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-environment-variable-exposure"
}
],
"title": "Renovate 42.68.1 before 42.96.3 Environment Variable Exposure",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76227",
"datePublished": "2026-08-19T14:02:09.384Z",
"dateReserved": "2026-08-19T11:36:02.573Z",
"dateUpdated": "2026-08-19T14:02:09.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76226 (GCVE-0-2026-76226)
Vulnerability from nvd – Published: 2026-08-19 14:02 – Updated: 2026-08-20 17:25
VLAI
EPSS
VEX
Title
Renovate 43.65.0 through 43.102.11 Remote Code Execution via lockFileMaintenance
Summary
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 17:25 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/renovate-thr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
43.65.0 , < 43.102.11
(semver)
Unaffected: 43.102.11 (semver) |
Date Public
2026-04-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76226",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T17:25:32.967650Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T17:25:43.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "43.102.11",
"status": "affected",
"version": "43.65.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "43.102.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "43.102.11",
"status": "affected",
"version": "43.65.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "43.102.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "43.102.11",
"status": "affected",
"version": "43.65.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "43.102.11",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "gzm0"
},
{
"lang": "en",
"type": "finder",
"value": "viceice"
}
],
"datePublic": "2026-04-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:08.689Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-5vjq-5jmg-39xq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-5vjq-5jmg-39xq"
},
{
"name": "VulnCheck Advisory: Renovate 43.65.0 through 43.102.11 Remote Code Execution via lockFileMaintenance",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-through-remote-code-execution-via-lockfilemaintenance"
}
],
"title": "Renovate 43.65.0 through 43.102.11 Remote Code Execution via lockFileMaintenance",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76226",
"datePublished": "2026-08-19T14:02:08.689Z",
"dateReserved": "2026-08-19T11:36:02.573Z",
"dateUpdated": "2026-08-20T17:25:43.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58376 (GCVE-0-2024-58376)
Vulnerability from nvd – Published: 2026-08-19 14:01 – Updated: 2026-08-20 15:23
VLAI
EPSS
VEX
Title
Renovate 37.158.0 before 37.199.0 Command Injection via helmv3
Summary
Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:52 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
37.158.0 , < 37.199.0
(semver)
Unaffected: 37.199.0 (semver) |
Date Public
2024-04-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-58376",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:52:34.194922Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:23:34.198Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "37.199.0",
"status": "affected",
"version": "37.158.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "37.199.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "meyfa"
}
],
"datePublic": "2024-04-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager\u0027s registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate\u0027s execution environment."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:01:49.687Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rqgv-292v-5qgr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-rqgv-292v-5qgr"
},
{
"name": "VulnCheck Advisory: Renovate 37.158.0 before 37.199.0 Command Injection via helmv3",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3"
}
],
"title": "Renovate 37.158.0 before 37.199.0 Command Injection via helmv3",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-58376",
"datePublished": "2026-08-19T14:01:49.687Z",
"dateReserved": "2026-08-16T13:02:14.690Z",
"dateUpdated": "2026-08-20T15:23:34.198Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-37267 (GCVE-0-2020-37267)
Vulnerability from nvd – Published: 2026-08-19 14:01 – Updated: 2026-08-19 15:31
VLAI
EPSS
VEX
Title
Renovate 19.180.0 before 23.25.1 Token Leakage via Logs
Summary
Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 15:31 UTC
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
19.180.0 , < 23.25.1
(semver)
Unaffected: 23.25.1 (semver) |
Date Public
2020-09-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-37267",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T15:31:17.977767Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T15:31:29.314Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "23.25.1",
"status": "affected",
"version": "19.180.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "23.25.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "ylemkimon"
}
],
"datePublic": "2020-09-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions \u003e=19.180.0 and \u003c23.25.1, when used with Azure DevOps, may expose the bot\u0027s authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:01:49.017Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-36rh-ggpr-j3gj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-36rh-ggpr-j3gj"
},
{
"name": "VulnCheck Advisory: Renovate 19.180.0 before 23.25.1 Token Leakage via Logs",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-token-leakage-via-logs"
}
],
"title": "Renovate 19.180.0 before 23.25.1 Token Leakage via Logs",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2020-37267",
"datePublished": "2026-08-19T14:01:49.017Z",
"dateReserved": "2026-08-19T11:37:41.053Z",
"dateUpdated": "2026-08-19T15:31:29.314Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2019-25766 (GCVE-0-2019-25766)
Vulnerability from nvd – Published: 2026-08-19 14:01 – Updated: 2026-08-19 14:01
VLAI
EPSS
VEX
Title
Renovate before 19.38.7 Credential Exposure via Go Modules
Summary
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.
Severity
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
13.87.0 , < 19.38.7
(semver)
Unaffected: 19.38.7 (semver) |
Date Public
2019-10-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "19.38.7",
"status": "affected",
"version": "13.87.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "19.38.7",
"versionType": "semver"
}
]
}
],
"datePublic": "2019-10-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions \u003e= 13.87.0 and \u003c= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:01:48.308Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-v7x3-7hw7-pcjg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-v7x3-7hw7-pcjg"
},
{
"name": "VulnCheck Advisory: Renovate before 19.38.7 Credential Exposure via Go Modules",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-credential-exposure-via-go-modules"
}
],
"title": "Renovate before 19.38.7 Credential Exposure via Go Modules",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2019-25766",
"datePublished": "2026-08-19T14:01:48.308Z",
"dateReserved": "2026-08-19T11:37:57.693Z",
"dateUpdated": "2026-08-19T14:01:48.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76233 (GCVE-0-2026-76233)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:02 – Updated: 2026-08-19 14:45
VLAI
EPSS
VEX
Title
Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager
Summary
Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:44 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://github.com/renovatebot/renovate/commit/d2… | patch |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
39.53.0 , < 40.33.0
(semver)
Unaffected: 40.33.0 (semver) |
Date Public
2026-01-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76233",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:44:43.669994Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:45:31.617Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-xjr7-3c3g-m763"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "40.33.0",
"status": "affected",
"version": "39.53.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "40.33.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "astellingwerf"
}
],
"datePublic": "2026-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:13.767Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xjr7-3c3g-m763)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-xjr7-3c3g-m763"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/d29698e0131231652970f02765312769975e4d38"
},
{
"name": "VulnCheck Advisory: Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-gleam-manager"
}
],
"title": "Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76233",
"datePublished": "2026-08-19T14:02:13.767Z",
"dateReserved": "2026-08-19T11:36:02.574Z",
"dateUpdated": "2026-08-19T14:45:31.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76232 (GCVE-0-2026-76232)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:02 – Updated: 2026-08-19 14:02
VLAI
EPSS
VEX
Title
Renovate 31.51.0 before 40.33.0 Command Injection via helmv3
Summary
Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate.
Severity
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://github.com/renovatebot/renovate/commit/f3… | patch |
| https://github.com/renovatebot/renovate/commit/a7… | patch |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
31.51.0 , < 40.33.0
(semver)
Unaffected: 40.33.0 (semver) |
Date Public
2026-01-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "40.33.0",
"status": "affected",
"version": "31.51.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "40.33.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "astellingwerf"
}
],
"datePublic": "2026-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:13.066Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3f44-xw83-3pmg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-3f44-xw83-3pmg"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/f372a68144a4d78c9f7f418168e4efe03336a432"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c"
},
{
"name": "VulnCheck Advisory: Renovate 31.51.0 before 40.33.0 Command Injection via helmv3",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3-2"
}
],
"title": "Renovate 31.51.0 before 40.33.0 Command Injection via helmv3",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76232",
"datePublished": "2026-08-19T14:02:13.066Z",
"dateReserved": "2026-08-19T11:36:02.574Z",
"dateUpdated": "2026-08-19T14:02:13.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76231 (GCVE-0-2026-76231)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:02 – Updated: 2026-08-20 16:06
VLAI
EPSS
VEX
Title
Renovate 32.135.0 before 40.33.0 Command Injection via hermit
Summary
Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 16:06 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://github.com/renovatebot/renovate/commit/b6… | patch |
| https://github.com/renovatebot/renovate/commit/ea… | patch |
| https://github.com/renovatebot/renovate/commit/41… | patch |
| https://github.com/renovatebot/renovate/commit/a7… | patch |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
32.135.0 , < 40.33.0
(semver)
Unaffected: 40.33.0 (semver) |
Date Public
2026-01-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76231",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T16:06:40.739994Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T16:06:47.842Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "40.33.0",
"status": "affected",
"version": "32.135.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "40.33.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "astellingwerf"
}
],
"datePublic": "2026-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:12.328Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-36j9-mx87-2cff)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/b696abb3c2741508fbb4029f39153140a3722e1e"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/eaec10d7c8afadbdd783ac47bd2adbfab444d6df"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/41e8b99f86a6e2a56f80f7aa1a08a59d76f2358c"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c"
},
{
"name": "VulnCheck Advisory: Renovate 32.135.0 before 40.33.0 Command Injection via hermit",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-hermit"
}
],
"title": "Renovate 32.135.0 before 40.33.0 Command Injection via hermit",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76231",
"datePublished": "2026-08-19T14:02:12.328Z",
"dateReserved": "2026-08-19T11:36:02.573Z",
"dateUpdated": "2026-08-20T16:06:47.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76230 (GCVE-0-2026-76230)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:02 – Updated: 2026-08-19 14:02
VLAI
EPSS
VEX
Title
Renovate 35.63.0 before 40.33.0 Command Injection via npm
Summary
Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate.
Severity
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://github.com/renovatebot/renovate/commit/01… | patch |
| https://github.com/renovatebot/renovate/commit/a7… | patch |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
35.63.0 , < 40.33.0
(semver)
Unaffected: 40.33.0 (semver) |
Date Public
2026-01-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "40.33.0",
"status": "affected",
"version": "35.63.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "40.33.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "astellingwerf"
}
],
"datePublic": "2026-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:11.620Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fr4j-65pv-gjjj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-fr4j-65pv-gjjj"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/012c0ac2fe32832e60a62bde405c0a241efd314c"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c"
},
{
"name": "VulnCheck Advisory: Renovate 35.63.0 before 40.33.0 Command Injection via npm",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-npm"
}
],
"title": "Renovate 35.63.0 before 40.33.0 Command Injection via npm",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76230",
"datePublished": "2026-08-19T14:02:11.620Z",
"dateReserved": "2026-08-19T11:36:02.573Z",
"dateUpdated": "2026-08-19T14:02:11.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76229 (GCVE-0-2026-76229)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:02 – Updated: 2026-08-20 15:22
VLAI
EPSS
VEX
Title
Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize
Summary
Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yaml files with specially crafted chart names to execute arbitrary commands on the Renovate host machine.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:53 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://github.com/renovatebot/renovate/commit/cc… | patch |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
39.218.0 , < 40.33.0
(semver)
Unaffected: 40.33.0 (semver) |
Date Public
2026-01-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76229",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:53:35.631045Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:22:57.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "40.33.0",
"status": "affected",
"version": "39.218.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "40.33.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "astellingwerf"
}
],
"datePublic": "2026-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yaml files with specially crafted chart names to execute arbitrary commands on the Renovate host machine."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:10.888Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xv56-3wq5-9997)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-xv56-3wq5-9997"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/renovatebot/renovate/commit/cc08c6e98f19e6258c5d3180c70c98e1be0b0d37"
},
{
"name": "VulnCheck Advisory: Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-arbitrary-command-injection-via-kustomize"
}
],
"title": "Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76229",
"datePublished": "2026-08-19T14:02:10.888Z",
"dateReserved": "2026-08-19T11:36:02.573Z",
"dateUpdated": "2026-08-20T15:22:57.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76228 (GCVE-0-2026-76228)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:02 – Updated: 2026-08-19 14:48
VLAI
EPSS
VEX
Title
Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper
Summary
Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url <value>). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:47 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
32.124.0 , < 42.68.5
(semver)
Unaffected: 42.68.5 (semver) |
|
| renovatebot | renovate |
Affected:
0 , < 13.3.0
(semver)
Unaffected: 13.3.0 (semver) |
Date Public
2026-01-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76228",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:47:23.066070Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:48:41.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.68.5",
"status": "affected",
"version": "32.124.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.68.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.68.5",
"status": "affected",
"version": "32.124.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.68.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.68.5",
"status": "affected",
"version": "32.124.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.68.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.68.5",
"status": "affected",
"version": "32.124.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.68.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "y4rvin"
}
],
"datePublic": "2026-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions \u003e=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url \u003cvalue\u003e). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:10.197Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pfq2-hh62-7m96)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96"
},
{
"name": "VulnCheck Advisory: Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-remote-code-execution-via-gradle-wrapper"
}
],
"title": "Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76228",
"datePublished": "2026-08-19T14:02:10.197Z",
"dateReserved": "2026-08-19T11:36:02.573Z",
"dateUpdated": "2026-08-19T14:48:41.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76227 (GCVE-0-2026-76227)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:02 – Updated: 2026-08-19 14:02
VLAI
EPSS
VEX
Title
Renovate 42.68.1 before 42.96.3 Environment Variable Exposure
Summary
Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.
Severity
5.5 (Medium)
CWE
- CWE-526 - Cleartext Storage of Sensitive Information in an Environment Variable
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
42.68.1 , < 42.96.3
(semver)
Unaffected: 42.96.3 (semver) |
|
| renovatebot | renovate |
Affected:
42.68.1 , < 43.4.4
(semver)
Unaffected: 43.4.4 (semver) |
|
| renovatebot | renovate |
Affected:
13.3.0 , < 13.6.0
(semver)
Unaffected: 13.6.0 (semver) |
Date Public
2026-02-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.96.3",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.96.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "43.4.4",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "43.4.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.96.3",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.96.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "43.4.4",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "43.4.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.96.3",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.96.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "43.4.4",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "43.4.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "42.96.3",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "42.96.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "43.4.4",
"status": "affected",
"version": "42.68.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "43.4.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "13.6.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "13.6.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "viceice"
}
],
"datePublic": "2026-02-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker \u003e=13.3.0 \u003c13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-526",
"description": "Cleartext Storage of Sensitive Information in an Environment Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:09.384Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8wc6-vgrq-x6cf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-8wc6-vgrq-x6cf"
},
{
"name": "VulnCheck Advisory: Renovate 42.68.1 before 42.96.3 Environment Variable Exposure",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-environment-variable-exposure"
}
],
"title": "Renovate 42.68.1 before 42.96.3 Environment Variable Exposure",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76227",
"datePublished": "2026-08-19T14:02:09.384Z",
"dateReserved": "2026-08-19T11:36:02.573Z",
"dateUpdated": "2026-08-19T14:02:09.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76226 (GCVE-0-2026-76226)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:02 – Updated: 2026-08-20 17:25
VLAI
EPSS
VEX
Title
Renovate 43.65.0 through 43.102.11 Remote Code Execution via lockFileMaintenance
Summary
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 17:25 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/renovate-thr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
43.65.0 , < 43.102.11
(semver)
Unaffected: 43.102.11 (semver) |
Date Public
2026-04-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76226",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T17:25:32.967650Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T17:25:43.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "43.102.11",
"status": "affected",
"version": "43.65.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "43.102.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "43.102.11",
"status": "affected",
"version": "43.65.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "43.102.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "43.102.11",
"status": "affected",
"version": "43.65.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "43.102.11",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "gzm0"
},
{
"lang": "en",
"type": "finder",
"value": "viceice"
}
],
"datePublic": "2026-04-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:02:08.689Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-5vjq-5jmg-39xq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-5vjq-5jmg-39xq"
},
{
"name": "VulnCheck Advisory: Renovate 43.65.0 through 43.102.11 Remote Code Execution via lockFileMaintenance",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-through-remote-code-execution-via-lockfilemaintenance"
}
],
"title": "Renovate 43.65.0 through 43.102.11 Remote Code Execution via lockFileMaintenance",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76226",
"datePublished": "2026-08-19T14:02:08.689Z",
"dateReserved": "2026-08-19T11:36:02.573Z",
"dateUpdated": "2026-08-20T17:25:43.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58376 (GCVE-0-2024-58376)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:01 – Updated: 2026-08-20 15:23
VLAI
EPSS
VEX
Title
Renovate 37.158.0 before 37.199.0 Command Injection via helmv3
Summary
Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:52 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
37.158.0 , < 37.199.0
(semver)
Unaffected: 37.199.0 (semver) |
Date Public
2024-04-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-58376",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:52:34.194922Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:23:34.198Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "37.199.0",
"status": "affected",
"version": "37.158.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "37.199.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "meyfa"
}
],
"datePublic": "2024-04-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager\u0027s registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate\u0027s execution environment."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:01:49.687Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rqgv-292v-5qgr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-rqgv-292v-5qgr"
},
{
"name": "VulnCheck Advisory: Renovate 37.158.0 before 37.199.0 Command Injection via helmv3",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3"
}
],
"title": "Renovate 37.158.0 before 37.199.0 Command Injection via helmv3",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-58376",
"datePublished": "2026-08-19T14:01:49.687Z",
"dateReserved": "2026-08-16T13:02:14.690Z",
"dateUpdated": "2026-08-20T15:23:34.198Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-37267 (GCVE-0-2020-37267)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:01 – Updated: 2026-08-19 15:31
VLAI
EPSS
VEX
Title
Renovate 19.180.0 before 23.25.1 Token Leakage via Logs
Summary
Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 15:31 UTC
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
19.180.0 , < 23.25.1
(semver)
Unaffected: 23.25.1 (semver) |
Date Public
2020-09-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-37267",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T15:31:17.977767Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T15:31:29.314Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "23.25.1",
"status": "affected",
"version": "19.180.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "23.25.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "ylemkimon"
}
],
"datePublic": "2020-09-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions \u003e=19.180.0 and \u003c23.25.1, when used with Azure DevOps, may expose the bot\u0027s authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:01:49.017Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-36rh-ggpr-j3gj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-36rh-ggpr-j3gj"
},
{
"name": "VulnCheck Advisory: Renovate 19.180.0 before 23.25.1 Token Leakage via Logs",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-token-leakage-via-logs"
}
],
"title": "Renovate 19.180.0 before 23.25.1 Token Leakage via Logs",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2020-37267",
"datePublished": "2026-08-19T14:01:49.017Z",
"dateReserved": "2026-08-19T11:37:41.053Z",
"dateUpdated": "2026-08-19T15:31:29.314Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2019-25766 (GCVE-0-2019-25766)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:01 – Updated: 2026-08-19 14:01
VLAI
EPSS
VEX
Title
Renovate before 19.38.7 Credential Exposure via Go Modules
Summary
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.
Severity
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/renovatebot/renovate/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/renovate-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| renovatebot | renovate |
Affected:
13.87.0 , < 19.38.7
(semver)
Unaffected: 19.38.7 (semver) |
Date Public
2019-10-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/renovate",
"product": "renovate",
"vendor": "renovatebot",
"versions": [
{
"lessThan": "19.38.7",
"status": "affected",
"version": "13.87.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "19.38.7",
"versionType": "semver"
}
]
}
],
"datePublic": "2019-10-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Renovate versions \u003e= 13.87.0 and \u003c= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:01:48.308Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-v7x3-7hw7-pcjg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-v7x3-7hw7-pcjg"
},
{
"name": "VulnCheck Advisory: Renovate before 19.38.7 Credential Exposure via Go Modules",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/renovate-before-credential-exposure-via-go-modules"
}
],
"title": "Renovate before 19.38.7 Credential Exposure via Go Modules",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2019-25766",
"datePublished": "2026-08-19T14:01:48.308Z",
"dateReserved": "2026-08-19T11:37:57.693Z",
"dateUpdated": "2026-08-19T14:01:48.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}