Command Injection

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Command Injection via the distributionType parameter in maven-wrapper.properties. An attacker can execute arbitrary commands by injecting shell code when the application processes Maven Wrapper updates ...

CVE-2026-88889

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...