Threat Intelligence Database

Renovate versions from 31.51.0 before 40.33.0 have a command injection vulnerability in the helmv3 manager. The vulnerability arises because the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can exploit this by crafting malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate.

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yaml files with specially crafted chart names to execute arbitrary commands on the Renovate host machine.

Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in the bazel-module and bazelisk managers when using lockFileMaintenance. This vulnerability allows attackers with high privileges to execute arbitrary code by supplying malicious dependencies referenced in bazel mod deps calls, such as within ctx.execute statements. The CVSS 4.0 base score is 6.8, indicating a medium severity level.

Renovate versions 37.158.0 before 37.199.0 have a critical OS command injection vulnerability in the helmv3 manager's registryAliases handling. This flaw allows attackers with commit access to execute arbitrary commands by injecting shell metacharacters into registryAliases keys. The injected commands run during helm repo add operations, potentially giving full control over Renovate's execution environment.