CVE-2026-88888 is an OS command injection vulnerability in renovatebot's renovate tool, specifically in the Mix manager's processing of private dependencies. The vulnerability arises from improper neutralization of special elements in organization parameters, allowing injection of shell metacharacters through malicious package names. Successful exploitation enables arbitrary command execution with the privileges of the Renovate user when operating in binarySource=docker mode. The CVSS 4.0 vector indicates a local attack vector requiring privileges and high complexity, with high impact on confidentiality, integrity, and availability.

An attacker with local access and limited privileges can exploit this vulnerability to execute arbitrary OS commands as the Renovate user. This could lead to unauthorized system access, data compromise, or disruption of Renovate operations. The high CVSS score reflects significant potential impact on system security if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when processing private dependencies with unescaped organization parameters, especially in binarySource=docker mode. Monitoring vendor channels for updates is recommended.