CVE-2026-88888

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.14.7

Description The Mix manager contains a flaw when processing private dependencies with unescaped organization parameters. An attacker can inject shell metacharacters via malicious package names to execute arbitrary commands as the Renovate user when operating in binarySource=docker mode. Command injection is a security issue where an attacker executes arbitrary operating system commands on a vulnerable server.

Recommendations Update to version 44.14.7 or later.