CVE-2026-88885 is an OS command injection vulnerability in renovatebot's renovate tool affecting versions before 44.14.7. The flaw exists in the gomod manager component when handling unescaped depName parameters in import-path update commands with binarySource=docker. This allows attackers to inject shell metacharacters through crafted dependency names, resulting in arbitrary command execution with the privileges of the Renovate user during Go module major version updates if postUpdateOptions gomodUpdateImportPaths is enabled.

Successful exploitation can lead to arbitrary command execution as the Renovate user, potentially allowing attackers to execute unauthorized commands on the host system. The vulnerability requires local access or an attacker with the ability to influence dependency names in the update process. The CVSS 4.0 score is 7.3 (high), reflecting the significant impact but requiring high attack complexity and privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid enabling postUpdateOptions gomodUpdateImportPaths with binarySource=docker mode or restrict input sources to trusted dependencies to reduce risk.