Vulnerabilities

TI-2026-60273 CVE-2026-88889 · GHSA-q946-5qg8-8wmj

Renovate before 44.14.7 Command Injection via distributionType

MEDIUM 41

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.pr…

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.01049 Published 2026-09-10 Fixed in 44.14.7, 15.4.0 +1 CWE-78

TI-2026-60272 CVE-2026-88888 · GHSA-x7x2-5fmx-8wj5

Renovate before 44.14.7 Command Injection via Mix organization

LOW 36

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters.

CVSS 4.0HIGH 7.3 Local Low privileges No interaction EPSS 0.00889 Published 2026-09-10 Fixed in 44.14.7, 15.4.0 +1 CWE-78

TI-2026-60271 CVE-2026-88887 · GHSA-xxxv-4m67-3vm5

Renovate before 44.11.2 Credential Exfiltration via Link Header

MEDIUM 46

Renovate is a dependency update automation tool.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00409 Published 2026-09-10 Fixed in 44.11.2, 15.4.0 +1 CWE-601

TI-2026-60270 CVE-2026-88886 · GHSA-5m6m-mfxc-qh95

Renovate before 44.14.7 Command Injection via gradle-wrapper

LOW 38

Renovate is a dependency update automation tool.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00227 Published 2026-09-10 Fixed in 44.14.7, 15.4.0 +1 CWE-78

TI-2026-60269 CVE-2026-88885 · GHSA-74v7-vgrr-xqjq

Renovate before 44.14.7 Command Injection via depName

LOW 36

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode.

CVSS 4.0HIGH 7.3 Local Low privileges No interaction EPSS 0.00889 Published 2026-09-10 Fixed in 44.14.7, 15.4.0 +1 CWE-78

TI-2026-60268 CVE-2026-88884 · GHSA-x9q2-x5p7-v69h

Renovate before 44.3.1 Authentication Bypass via Digest Updates

LOW 36

Renovate is a dependency update automation tool.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00305 Published 2026-09-10 Fixed in 44.3.1, 15.4.0 +1 CWE-863

TI-2026-60267 CVE-2026-88883 · GHSA-qfw4-mmpc-67w5

Renovate before 44.14.4 TLS Private Key Log Sanitisation

LOW 36

Renovate is an automated dependency update tool.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00386 Published 2026-09-10 Fixed in 44.14.4, 15.4.0 +1 CWE-532

TI-2026-60266 CVE-2026-88882 · GHSA-978f-wwpx-5hh6

Renovate before 44.11.2 Credential Exfiltration via Link Header

MEDIUM 46

Renovate is a dependency update automation tool.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00409 Published 2026-09-10 Fixed in 44.11.2, 15.4.0 +1 CWE-601

TI-2026-60265 CVE-2026-88881 · GHSA-gwwm-f4gw-c69f

Renovate before 44.11.3 Credential Exfiltration via Link Header

MEDIUM 46

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the c…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00409 Published 2026-09-10 Fixed in 44.11.3, 15.4.0 +1 CWE-601

TI-2026-60264 CVE-2026-88880 · GHSA-wqcg-39wp-gpqc

Renovate before 44.11.3 Credential Exfiltration via Link Header

MEDIUM 46

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00504 Published 2026-09-10 Fixed in 44.11.3, 15.4.0 +1 CWE-601

Vulnerabilities

Filters