CVE-2026-76229 Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

EUVD-2026-62470

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76229

Renovate (dependency update bot) versions from 39.218.9 (March 26, 2025) before 40.33.0 contain an arbitrary command injection in the kustomize manager . The depName argument passed to the helmRepositoryArgs function in lib/modules/manager/kustomize/artifacts.ts is not escaped using shlex.quote b...

CVE-2026-76229 Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2024-58376

Renovate versions 37.158.0 through 37.198.0 are vulnerable to a command injection flaw in the helmv3 manager . The root cause is the improper handling of registryAliases, where the software fails to quote the keys. Attackers with commit access to a repository can inject unquoted shell metacharact...

CVE-2024-58376 Renovate 37.158.0 before 37.199.0 Command Injection via helmv3

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...

CVE-2024-58376 Renovate 37.158.0 before 37.199.0 Command Injection via helmv3

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...

PT-2026-78411

Name of the Vulnerable Software and Affected Versions Renovate versions 39.218.0 through 40.32.0 Description The kustomize manager allows arbitrary command injection because user-provided chart names are appended to helm pull commands without proper sanitization. An attacker with repository write...

CVE-2026-76229: Improper Neutralization of Special Elements used in a Command

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2024-58376: Improper Neutralization of Special Elements used in an OS Command

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...

Helm: Helm: Denial of Service via malformed chart files

A flaw was found in Helm. A remote attacker can exploit a denial of service vulnerability by including zero-length byte slices, such as empty files, within Helm chart files. This can trigger an index out of range panic in the Files.Lines template helper, leading to deterministic render failures...

GHSA-7QCH-W8M5-G3H3 vulnerabilities

Vulnerabilities for packages: nginx-prometheus-exporter, buf, k9s, kubescape, mountpoint-s3-csi-driver, lazygit, nuclei, tempo, opentelemetry-collector-contrib, kratos, mcp-grafana, k6, octo-sts, restic, nsc, tfsec, percona-server-mongodb-operator, configmap-reload, rancher-agent, tetragon,...

GHSA-C974-W86C-VPFW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, bento, gogatekeeper, vexctl, tkn, trino, nginx-prometheus-exporter, cerbos, buf, crossplane-provider-aws-rds, k9s, kubescape, pulumi-language-java, helm-set-status, k8ssandra-client, podinfo, nuclei, tempo, opentelemetry-collector-contrib...

GHSA-76P8-FHRM-VPC7 vulnerabilities

Vulnerabilities for packages: k9s, kubescape, mountpoint-s3-csi-driver, nuclei, opentelemetry-collector-contrib, mcp-grafana, k6, octo-sts, restic, tfsec, percona-server-mongodb-operator, rancher-agent, tetragon, sftpgo-plugin-eventsearch, seaweedfs, kubernetes-dashboard-api, minio, sonobuoy,...

GO-2026-6091 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, bento, gogatekeeper, vexctl, tkn, trino, nginx-prometheus-exporter, cerbos, buf, crossplane-provider-aws-rds, k9s, kubescape, pulumi-language-java, helm-set-status, k8ssandra-client, podinfo, nuclei, tempo, opentelemetry-collector-contrib...

CVE-2026-56858 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, bento, gogatekeeper, vexctl, tkn, trino, nginx-prometheus-exporter, cerbos, buf, crossplane-provider-aws-rds, k9s, kubescape, pulumi-language-java, helm-set-status, k8ssandra-client, podinfo, nuclei, tempo, opentelemetry-collector-contrib...

CVE-2026-33818 vulnerabilities

Vulnerabilities for packages: nginx-prometheus-exporter, buf, k9s, kubescape, mountpoint-s3-csi-driver, lazygit, nuclei, tempo, opentelemetry-collector-contrib, kratos, mcp-grafana, k6, octo-sts, restic, nsc, tfsec, percona-server-mongodb-operator, configmap-reload, rancher-agent, tetragon,...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: nginx-prometheus-exporter, buf, k9s, kubescape, mountpoint-s3-csi-driver, lazygit, nuclei, tempo, opentelemetry-collector-contrib, kratos, mcp-grafana, k6, octo-sts, restic, nsc, tfsec, percona-server-mongodb-operator, configmap-reload, rancher-agent, tetragon,...

GO-2026-5972 vulnerabilities

Vulnerabilities for packages: nginx-prometheus-exporter, buf, k9s, kubescape, mountpoint-s3-csi-driver, lazygit, nuclei, tempo, opentelemetry-collector-contrib, kratos, mcp-grafana, k6, octo-sts, restic, nsc, tfsec, percona-server-mongodb-operator, configmap-reload, rancher-agent, tetragon,...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: nginx-prometheus-exporter, buf, k9s, kubescape, mountpoint-s3-csi-driver, lazygit, nuclei, tempo, opentelemetry-collector-contrib, kratos, mcp-grafana, k6, octo-sts, restic, nsc, tfsec, percona-server-mongodb-operator, configmap-reload, rancher-agent, tetragon,...