CVE-2026-110867 Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LDPRELOAD, NODEOPTIONS, or GITSSLCAINFO i...

CVE-2026-110867

Versions of Renovate prior to 44.60.1 are vulnerable to an allowlist bypass where repositories can set restricted environment variables by embedding them within a shared preset . An attacker who controls an externally sourced preset can override critical environment variables, such as PATH , LD_P...