Renovate 37.158.0 before 37.199.0 Command Injection via helmv3
Priority MEDIUM 46CWE-78Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00686 52nd percentileScored 2026-11-07
Fix Fixed renovate (renovatebot): 37.199.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| renovatebot | renovate | 37.158.0 to before 37.199.0 | 37.199.0 | Patch available | CNA |
- renovate Vendorrenovatebot Affected 37.158.0 to before 37.199.0 Fixed in 37.199.0 Patch available CNA
Remediation
- Fix · CNA renovate (renovatebot) Fixed in 37.199.0
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2024-58376
- 2026-10-03 Alias added: GHSA-7vwx-mgm6-w2m7
References
More renovatebot vulnerabilities
- TI-2026-53338 Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager CVSS 4.0HIGH 8.4
- TI-2026-53337 Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 CVSS 4.0HIGH 8.4
- TI-2026-53336 Renovate 32.135.0 before 40.33.0 Command Injection via hermit CVSS 4.0HIGH 8.4
- TI-2026-53335 Renovate 35.63.0 before 40.33.0 Command Injection via npm CVSS 4.0HIGH 8.4
- TI-2026-53333 Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper CVSS 4.0HIGH 8.4
- TI-2026-60271 Renovate before 44.11.2 Credential Exfiltration via Link Header CVSS 4.0CRITICAL 9.2
Sources
- CVE-2024-58376 · CVE Program
- CVE-2024-58376 · NVD
- FIRST EPSS
- GHSA-7vwx-mgm6-w2m7 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-58376 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences