Renovate versions prior to 44.14.7 (and Mend Renovate CE/EE before 15.4.0, and mend-renovate-enterprise-edition Helm chart before 10.4.0) contain an OS command injection vulnerability in the manager/gradle-wrapper module. The vulnerability occurs because the distributionUrl value read from gradle/wrapper/gradle-wrapper.properties is not escaped before being passed to the Gradle Wrapper CLI. In self-hosted setups with binarySource=docker and allowedUnsafeExecutions containing 'gradleWrapper', a malicious repository can craft a distributionUrl with shell metacharacters and commands, causing arbitrary commands to execute as the Renovate user during Gradle Wrapper updates. The issue is fixed in Renovate 44.14.7. A workaround is to remove 'gradleWrapper' from allowedUnsafeExecutions.

Successful exploitation allows an attacker controlling a repository to execute arbitrary OS commands with the privileges of the Renovate user on self-hosted deployments configured with binarySource=docker and allowedUnsafeExecutions including 'gradleWrapper'. This can lead to full compromise of the Renovate host environment under these conditions.

Upgrade Renovate to version 44.14.7 or later, Mend Renovate CE/EE to 15.4.0 or later, or the mend-renovate-enterprise-edition Helm chart to 10.4.0 or later to fully remediate the vulnerability. As a temporary workaround, remove 'gradleWrapper' from the allowedUnsafeExecutions configuration to prevent exploitation. No vendor advisory explicitly states otherwise.