Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: renovatebot renovate 40.33.0 Clear all filters
TI-2026-53338 CVE-2026-76233 · GHSA-xmpw-q5r4-p783

Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager

Priority HIGH 72

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization.

CVSS 4.0HIGH 8.4 Local High privileges No interaction EPSS 0.01003 Published 2026-08-19 Fixed in 40.33.0 CWE-77
TI-2026-53337 CVE-2026-76232 · GHSA-v5qg-6f86-qw4x

Renovate 31.51.0 before 40.33.0 Command Injection via helmv3

Priority HIGH 72

Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization.

CVSS 4.0HIGH 8.4 Local High privileges No interaction EPSS 0.01014 Published 2026-08-19 Fixed in 40.33.0 CWE-77
TI-2026-53336 CVE-2026-76231 · GHSA-jjmm-46cq-987q

Renovate 32.135.0 before 40.33.0 Command Injection via hermit

Priority HIGH 72

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitizati…

CVSS 4.0HIGH 8.4 Local High privileges No interaction EPSS 0.01019 Published 2026-08-19 Fixed in 40.33.0 CWE-77
TI-2026-53335 CVE-2026-76230 · GHSA-8rp2-gc6p-4hgp

Renovate 35.63.0 before 40.33.0 Command Injection via npm

Priority HIGH 72

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization.

CVSS 4.0HIGH 8.4 Local High privileges No interaction EPSS 0.01014 Published 2026-08-19 Fixed in 40.33.0 CWE-77
TI-2026-53334 CVE-2026-76229 · GHSA-5gfg-jpw3-fppq

Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

Priority MEDIUM 40

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization.

CVSS 4.0HIGH 8.4 Local High privileges No interaction EPSS 0.01003 Published 2026-08-19 Fixed in 40.33.0 CWE-77