18 matches found
CVE-2026-76226
A flaw was found in Renovate. This vulnerability affects the bazel-module and bazelisk managers when processing lockFileMaintenance. A remote attacker can exploit this by providing malicious dependencies, leading to the execution of arbitrary code. This occurs when these dependencies are referenc...
Malicious Package
Overview bazelisk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
CVE-2026-76226
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...
EUVD-2026-62467
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...
CVE-2026-76226 Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...
CVE-2026-76226 Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...
CVE-2026-76226
Renovate 43.65.0 through 43.102.10 has an RCE flaw: when lockFileMaintenance runs, bazel-module/bazelisk managers process malicious deps via bazel mod deps ctx.execute calls, allowing arbitrary code execution. CVSS 6.3 (medium). Upgrade to 43.102.11. No in-the-wild exploitation reported in provid...
CVE-2026-76226 Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...
MAL-2026-14227 Malicious code in bazelisk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4bcbd35130e716d1a2940c91b6691d41b9655fdc8587404af37bc6e5a7f1370 This npm package uses the name bazelisk, colliding with Google's bazelbuild/bazelisk project referenced in the tarball's source.txt, and self-labels ...
Malicious code in bazelisk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4bcbd35130e716d1a2940c91b6691d41b9655fdc8587404af37bc6e5a7f1370 This npm package uses the name bazelisk, colliding with Google's bazelbuild/bazelisk project referenced in the tarball's source.txt, and self-labels ...
CVE-2026-76226: Improper Neutralization of Special Elements used in an OS Command
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...
PT-2026-78408
Name of the Vulnerable Software and Affected Versions Renovate versions 43.65.0 through 43.102.10 Description A remote code execution issue exists in the bazel-module and bazelisk managers when the lockFileMaintenance feature is enabled. An attacker can execute arbitrary code by supplying malicio...
Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance
When using lockFileMaintenance using the bazel-module or bazelisk managers between Renovate 43.65.0 2026-03-12 and 43.102.11 2026-04-02, there was the opportunity for remote code execution from a malicious dependency, if the Bazel module executes code that relies on a dependency. As this is an...
GHSA-5VJQ-5JMG-39XQ Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance
When using lockFileMaintenance using the bazel-module or bazelisk managers between Renovate 43.65.0 2026-03-12 and 43.102.11 2026-04-02, there was the opportunity for remote code execution from a malicious dependency, if the Bazel module executes code that relies on a dependency. As this is an...
PT-2026-35211
When using lockFileMaintenance using the bazel-module or bazelisk managers between Renovate 43.65.0 2026-03-12 and 43.102.11 2026-04-02, there was the opportunity for remote code execution from a malicious dependency, if the Bazel module executes code that relies on a dependency . As this is an...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: thanos-operator, cloud-provider-azure, kustomize, amass, goreleaser, newrelic-nri-statsd, mockery, rancher-agent, dex, percona-server-mongodb-operator, rook, spicedb-operator, argo-cd, hubble, aws-signer-notation-plugin, rancher-webhook, cert-exporter,...
GHSA-FGQ5-Q76C-GX78 vulnerabilities
Vulnerabilities for packages: sbom-scorecard, thanos-operator, paranoia, kine, k8ssandra-operator, hubble-ui, kustomize, amass, gke-gcloud-auth-plugin, goreleaser, scorecard, configmap-reload, src, terraform, kor, grafana-operator, kube-rbac-proxy, kubernetes-dns-node-cache, mockery, nri-redis,...
GHSA-J6M3-GC37-6R6Q vulnerabilities
Vulnerabilities for packages: sbom-scorecard, thanos-operator, paranoia, kine, k8ssandra-operator, hubble-ui, kustomize, amass, gke-gcloud-auth-plugin, goreleaser, scorecard, configmap-reload, src, terraform, kor, grafana-operator, kube-rbac-proxy, kubernetes-dns-node-cache, mockery, nri-redis,...