CVE-2026-76226

A flaw was found in Renovate. This vulnerability affects the bazel-module and bazelisk managers when processing lockFileMaintenance. A remote attacker can exploit this by providing malicious dependencies, leading to the execution of arbitrary code. This occurs when these dependencies are referenc...

CVE-2026-76226

Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...

CVE-2026-76226

Renovate 43.65.0 through 43.102.10 has an RCE flaw: when lockFileMaintenance runs, bazel-module/bazelisk managers process malicious deps via bazel mod deps ctx.execute calls, allowing arbitrary code execution. CVSS 6.3 (medium). Upgrade to 43.102.11. No in-the-wild exploitation reported in provid...

CVE-2026-76226 Renovate 43.65.0 through 43.102.11 Remote Code Execution via lockFileMaintenance

Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...

EUVD-2026-62467

Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...

CVE-2026-76226 Renovate 43.65.0 through 43.102.11 Remote Code Execution via lockFileMaintenance

Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...

Malicious code in bazelisk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4bcbd35130e716d1a2940c91b6691d41b9655fdc8587404af37bc6e5a7f1370 This npm package uses the name bazelisk, colliding with Google's bazelbuild/bazelisk project referenced in the tarball's source.txt, and self-labels ...

PT-2026-78408

Name of the Vulnerable Software and Affected Versions Renovate versions 43.65.0 through 43.102.10 Description A remote code execution issue exists in the bazel-module and bazelisk managers when the lockFileMaintenance feature is enabled. An attacker can execute arbitrary code by supplying malicio...

GHSA-5VJQ-5JMG-39XQ Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance

When using lockFileMaintenance using the bazel-module or bazelisk managers between Renovate 43.65.0 2026-03-12 and 43.102.11 2026-04-02, there was the opportunity for remote code execution from a malicious dependency, if the Bazel module executes code that relies on a dependency. As this is an...

Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance

When using lockFileMaintenance using the bazel-module or bazelisk managers between Renovate 43.65.0 2026-03-12 and 43.102.11 2026-04-02, there was the opportunity for remote code execution from a malicious dependency, if the Bazel module executes code that relies on a dependency. As this is an...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-azure, dockerize, cloud-provider-azure, descheduler, apache-exporter, direnv, buildah, mods, paranoia, pguser, volume-modifier-for-k8s, xeol, redpanda, nri-haproxy, aws-signer-notation-plugin, kubescape, redka, mc, nova,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-azure, nuclei, dockerize, mongo-tools, spark-operator, tailscale, docker-cli, direnv, kube-bench, vault-k8s, vexctl, paranoia, gops, nri-elasticsearch, volume-modifier-for-k8s, nri-haproxy, dagger, thanos, kwok, ferretdb,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-azure, nuclei, dockerize, mongo-tools, spark-operator, tailscale, docker-cli, direnv, kube-bench, vault-k8s, vexctl, paranoia, gops, nri-elasticsearch, volume-modifier-for-k8s, nri-haproxy, dagger, thanos, kwok, ferretdb,...