Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: renovatebot renovate 44.14.7 Clear all filters
TI-2026-60273 CVE-2026-88889 · GHSA-q946-5qg8-8wmj

Renovate before 44.14.7 Command Injection via distributionType

Priority MEDIUM 41

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.pr…

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.01049 Published 2026-09-10 Fixed in 44.14.7, 15.4.0 +1 CWE-78
TI-2026-60272 CVE-2026-88888 · GHSA-x7x2-5fmx-8wj5

Renovate before 44.14.7 Command Injection via Mix organization

Priority LOW 36

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters.

CVSS 4.0HIGH 7.3 Local Low privileges No interaction EPSS 0.00889 Published 2026-09-10 Fixed in 44.14.7, 15.4.0 +1 CWE-78
TI-2026-60269 CVE-2026-88885 · GHSA-74v7-vgrr-xqjq

Renovate before 44.14.7 Command Injection via depName

Priority LOW 36

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode.

CVSS 4.0HIGH 7.3 Local Low privileges No interaction EPSS 0.00889 Published 2026-09-10 Fixed in 44.14.7, 15.4.0 +1 CWE-78