Threat database

CVE-2026-76227 is a vulnerability in renovatebot's renovate tool where environment variables are not restricted when spawning child processes. This allows child processes to access all environment variables of the parent Renovate process, potentially exposing sensitive information. The issue affects multiple renovate versions and Docker images prior to specific fixed versions. The vulnerability has a medium severity score of 6.8 CVSS v4.0.

Renovate versions from 43.65.0 up to but not including 43.102.11 contain a remote code execution vulnerability in the bazel-module and bazelisk managers when using lockFileMaintenance. This vulnerability allows attackers with high privileges to execute arbitrary code by supplying malicious dependencies referenced in bazel mod deps calls, including within ctx.execute statements. The vulnerability has a medium severity score of 6.8 CVSS v4.0.

Renovate versions from 37.158.0 up to but not including 37.199.0 have a command injection vulnerability in the helmv3 manager's registryAliases handling. Attackers with commit access can inject arbitrary OS commands by exploiting unquoted shell metacharacters in registryAliases keys. These commands execute during helm repo add operations, potentially allowing full access to Renovate's execution environment. The vulnerability has a high severity score of 8.4.