81 matches found
hermit
Hermit Hermes Reverse Engineering & Manipulation Interactive Toolkit. hermit inspects, decompiles and structurally patches Hermes bytecode HBC, the format React Native apps ship their JavaScript in. Open an .hbc file, browse its functions, read the decompiled JavaScript, edit instructions, string...
CVE-2026-76231
A flaw was found in Renovate. Attackers with repository write access can exploit a command injection vulnerability in the hermit manager. This occurs because user-provided dependency names are not properly sanitized when appended to install and uninstall commands. Successful exploitation allows a...
CVE-2026-76231
Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...
CVE-2026-76231 Renovate 32.135.0 before 40.33.0 Command Injection via hermit
Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...
CVE-2026-76231
Affected: Renovate bot versions 32.135.0 to before 40.33.0. Root cause: The hermit manager appends user-supplied dependency names to shell install/uninstall commands without sanitization. Impact: Attackers with repository write access can inject malicious dependency names to execute arbitrary com...
CVE-2026-76231 Renovate 32.135.0 before 40.33.0 Command Injection via hermit
Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...
EUVD-2026-62472
Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...
CVE-2026-76231: Improper Neutralization of Special Elements used in a Command
Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...
PT-2026-78413
Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...
cvhelper (0.1.0), deepomatic-cli (>=0.3.0, <=0.5.1) +4 more potentially affected by CVE-2019-15939 via opencv-python (3.4.3.18)
opencv-python PYPI version 3.4.3.18 is affected by a known vulnerability. The following packages have a transitive dependency on opencv-python and may be impacted: - cvhelper 0.1.0 - deepomatic-cli =0.3.0, =2.0.0, =0.1.7, =0.3.3, =1.1.0, =1.4.0 Source cves: CVE-2019-15939 Source advisory:...
box-oauth (>=0.2.5, <=0.3.1), chaostoolkit-openstack (>=0.1.0, <=0.1.1) +7 more potentially affected by CVE-2025-71176 via pytest (4.4.0)
pytest PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - box-oauth =0.2.5, =0.1.0, =0.1.7, =1.1.7, =0.0.1, =2019.4.3, =0.0.1, =1.0.1 Source cves: CVE-2025-71176 Source advisory: OSV:GHSA-6W46-J5RX-G56G...
Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies
Summary The user-provided string depName in the hermit manager is appended to the ./hermit install and ./hermit uninstall commands without proper sanitization. Details Adversaries can provide a maliciously named hermit dependency in conjunctions with a tweaked Renovate configuration file to trick...
EUVD-2026-2095
Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies...
GHSA-36J9-MX87-2CFF Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies
Summary The user-provided string depName in the hermit manager is appended to the ./hermit install and ./hermit uninstall commands without proper sanitization. Details Adversaries can provide a maliciously named hermit dependency in conjunctions with a tweaked Renovate configuration file to trick...
Arbitrary Command Injection
Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Arbitrary Command Injection due to the improper sanitazation of user-supplied depName in the packagesToInstall and packagesToUninstall functions of hermit manager. An attacker can execute arbitrary...
PT-2026-4553
Summary The user-provided string depName in the hermit manager is appended to the ./hermit install and ./hermit uninstall commands without proper sanitization. Details Adversaries can provide a maliciously named hermit dependency in conjunctions with a tweaked Renovate configuration file to trick...
EUVD-2022-33750
Malicious code in bioql PyPI...
EUVD-2022-33748
Malicious code in bioql PyPI...