GHSA-8wc6-vgrq-x6cf
Medium · 5.5CVSS
5.5
EPSS
—
Published
Feb 13, 2026
CISA due date
—
The record
Child processes spawned by Renovate incorrectly have full access to environment variables
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | renovate | 42.68.1 | 42.96.3 |
| npm | renovate | 43.0.0 | 43.4.4 |
Related vulnerabilities
- GHSA-5vjq-5jmg-39xq Renovate affected by remote code execution was possible using the bazel-module or… Also affects renovate
- GHSA-3f44-xw83-3pmg Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious… Also affects renovate
- GHSA-xjr7-3c3g-m763 Renovate vulnerable to arbitrary command injection via gleam manager and malicious… Also affects renovate
- GHSA-36j9-mx87-2cff Renovate vulnerable to arbitrary command injection via hermit manager and maliciously… Also affects renovate
- GHSA-fr4j-65pv-gjjj Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate… Also affects renovate
- GHSA-xv56-3wq5-9997 Renovate vulnerable to arbitrary command injection via kustomize manager and malicious… Also affects renovate
- GHSA-pfq2-hh62-7m96 Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious… Also affects renovate
- CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability… CWE-269