GHSA-5vjq-5jmg-39xq
Medium · 6.3CVSS
6.3
EPSS
—
Published
Apr 16, 2026
CISA due date
—
The record
Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | renovate | 43.65.0 | 43.102.11 |
Related vulnerabilities
- GHSA-8wc6-vgrq-x6cf Child processes spawned by Renovate incorrectly have full access to environment variables Also affects renovate
- GHSA-3f44-xw83-3pmg Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious… Also affects renovate
- GHSA-xjr7-3c3g-m763 Renovate vulnerable to arbitrary command injection via gleam manager and malicious… Also affects renovate
- GHSA-36j9-mx87-2cff Renovate vulnerable to arbitrary command injection via hermit manager and maliciously… Also affects renovate
- GHSA-fr4j-65pv-gjjj Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate… Also affects renovate
- GHSA-xv56-3wq5-9997 Renovate vulnerable to arbitrary command injection via kustomize manager and malicious… Also affects renovate
- GHSA-pfq2-hh62-7m96 Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious… Also affects renovate
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94