PT-2026-89400 · Git+1 · Renovate
CVSS v4.0
8.5
عالية
| المتجه | AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Renovate versions prior to 44.14.7
Description
The Maven Wrapper manager contains a flaw that allows remote code execution. An attacker can execute arbitrary shell commands by providing a malicious value for the
distributionType parameter within the maven-wrapper.properties file. This occurs when Renovate processes Maven Wrapper updates while operating in binarySource=docker mode, as the distributionType values are not properly escaped.Recommendations
Update to version 44.14.7 or later.
استغلال
إصلاح
OS Command Injection
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Renovate