CVE-2026-76226

Renovate 43.65.0 through 43.102.10 has an RCE flaw: when lockFileMaintenance runs, bazel-module/bazelisk managers process malicious deps via bazel mod deps ctx.execute calls, allowing arbitrary code execution. CVSS 6.3 (medium). Upgrade to 43.102.11. No in-the-wild exploitation reported in provid...

EUVD-2026-62467

Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...

Malicious code in bazelisk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4bcbd35130e716d1a2940c91b6691d41b9655fdc8587404af37bc6e5a7f1370 This npm package uses the name bazelisk, colliding with Google's bazelbuild/bazelisk project referenced in the tarball's source.txt, and self-labels ...

GHSA-5VJQ-5JMG-39XQ Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance

When using lockFileMaintenance using the bazel-module or bazelisk managers between Renovate 43.65.0 2026-03-12 and 43.102.11 2026-04-02, there was the opportunity for remote code execution from a malicious dependency, if the Bazel module executes code that relies on a dependency. As this is an...

Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance

When using lockFileMaintenance using the bazel-module or bazelisk managers between Renovate 43.65.0 2026-03-12 and 43.102.11 2026-04-02, there was the opportunity for remote code execution from a malicious dependency, if the Bazel module executes code that relies on a dependency. As this is an...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: nri-rabbitmq, kserve-modelmesh-serving, xeol, mariadb-operator, pluto, grafana-rollout-operator, litefs, external-dns, cri-tools, argo-cd, crossplane-provider-sql, gobuster, kor, gitsign, nri-apache, clickhouse-operator, emissary, spire-server, vault-k8s,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: velero, nri-rabbitmq, kubeflow-pipelines, pulumi-kubernetes-operator, minio, supercronic, go-bindata, tailscale, flux-image-automation-controller, kubevela, temporal, kube-state-metrics, pombump, litefs, vt-cli, sbom-scorecard, runc, cri-tools, kor, gobuster,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: velero, nri-rabbitmq, kubeflow-pipelines, pulumi-kubernetes-operator, minio, supercronic, go-bindata, tailscale, flux-image-automation-controller, kubevela, temporal, kube-state-metrics, pombump, litefs, vt-cli, sbom-scorecard, runc, cri-tools, kor, gobuster,...