Threats tagged 'ghsa-xmpw-q5r4-p783'

Renovate versions 39.53.0 up to but not including 40.33.0 have a command injection vulnerability in the gleam manager. The depName parameter is not properly sanitized, allowing an attacker with repository write access to execute arbitrary commands on the host running Renovate by crafting malicious gleam.toml files. This vulnerability has a high severity with a CVSS score of 8.4.