GHSA-36j9-mx87-2cff
Medium · 6.7CVSS
6.7
EPSS
—
Published
Jan 13, 2026
CISA due date
—
The record
Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | renovate | 32.135.0 | 40.33.0 |
Related vulnerabilities
- GHSA-5vjq-5jmg-39xq Renovate affected by remote code execution was possible using the bazel-module or… Also affects renovate
- GHSA-8wc6-vgrq-x6cf Child processes spawned by Renovate incorrectly have full access to environment variables Also affects renovate
- GHSA-3f44-xw83-3pmg Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious… Also affects renovate
- GHSA-xjr7-3c3g-m763 Renovate vulnerable to arbitrary command injection via gleam manager and malicious… Also affects renovate
- GHSA-fr4j-65pv-gjjj Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate… Also affects renovate
- GHSA-xv56-3wq5-9997 Renovate vulnerable to arbitrary command injection via kustomize manager and malicious… Also affects renovate
- GHSA-pfq2-hh62-7m96 Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious… Also affects renovate
- CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. CWE-77