Command Injection

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Command Injection in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. An attacker can execute arbitrary commands as the...

CVE-2026-88885

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...

CVE-2026-88885 Renovate before 44.14.7 Command Injection via depName

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...

CVE-2026-88885 Renovate before 44.14.7 Command Injection via depName

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...

EUVD-2026-75435

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...

CVE-2026-88885 Renovate before 44.14.7 Command Injection via depName

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...

CVE-2026-88885

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager . When processing unescaped depName parameters in import-path update commands with binarySource=docker mode, attackers can inject shell metacharacters through malicious dependency names to execute arbitrary co...

PT-2026-89396

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.14.7 Description A command injection issue exists in the gomod manager when processing unescaped depName parameters during import-path update commands while operating in binarySource=docker mode. This occurs durin...

CVE-2026-88885: Improper Neutralization of Special Elements used in an OS Command

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...

CVE-2026-76233

A flaw was found in Renovate. This command injection vulnerability exists within the gleam manager, where the 'depName' parameter is not properly sanitized when appended to 'gleam deps update' commands. An attacker with repository write access can exploit this by crafting malicious 'gleam.toml'...

CVE-2026-76233

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute...

EUVD-2026-62474

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute...

CVE-2026-76233 Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute...

CVE-2026-76233 Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute...

CVE-2026-76233 Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute...

CVE-2026-76233

Renovate versions 39.53.0 through before 40.33.0 are affected by a command injection vulnerability in the gleam manager . The depName parameter from gleam.toml is appended to gleam deps update shell commands without proper sanitization (missing quote from the shlex package in lib/modules/manager/...

CVE-2026-76233: Improper Neutralization of Special Elements used in a Command

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute...

PT-2026-78415

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute...

Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file

Summary The user-provided string depName in the gleam manager is appended to the gleam deps update command without proper sanitization. Details Adversaries can provide a maliciously crafted gleam.toml in conjunctions with a tweaked Renovate configuration file to trick Renovate to execute arbitrar...

Arbitrary Command Injection

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Arbitrary Command Injection due to the improper sanitazation of user-supplied depName in the packagesToUpdate functions of gleam manager. An attacker can execute arbitrary commands on the host system by...