Renovate 35.63.0 before 40.33.0 Command Injection via npm
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.4epss 0.9%
exploitation probability
0.9%top 42% of all CVEs
observed exploitation
nono source reports it
Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate.
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
renovatebot · renovateReferences
https://github.com/renovatebot/renovate/commit/012c0ac2fe32832e60a62bde405c0a241efd314chttps://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30chttps://github.com/renovatebot/renovate/security/advisories/GHSA-fr4j-65pv-gjjjhttps://www.vulncheck.com/advisories/renovate-before-command-injection-via-npm