GHSA-pfq2-hh62-7m96
Medium · 6.7CVSS
6.7
EPSS
—
Published
Jan 13, 2026
CISA due date
—
The record
Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | renovate | 32.124.0 | 42.68.5 |
Related vulnerabilities
- GHSA-5vjq-5jmg-39xq Renovate affected by remote code execution was possible using the bazel-module or… Also affects renovate
- GHSA-8wc6-vgrq-x6cf Child processes spawned by Renovate incorrectly have full access to environment variables Also affects renovate
- GHSA-3f44-xw83-3pmg Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious… Also affects renovate
- GHSA-xjr7-3c3g-m763 Renovate vulnerable to arbitrary command injection via gleam manager and malicious… Also affects renovate
- GHSA-36j9-mx87-2cff Renovate vulnerable to arbitrary command injection via hermit manager and maliciously… Also affects renovate
- GHSA-fr4j-65pv-gjjj Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate… Also affects renovate
- GHSA-xv56-3wq5-9997 Renovate vulnerable to arbitrary command injection via kustomize manager and malicious… Also affects renovate
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78