Astellingwerf

**Name of the Vulnerable Software and Affected Versions** Renovate versions 39.218.0 through 40.32.0 **Description** The kustomize manager allows arbitrary command injection because user-provided chart names are appended to helm pull commands without proper sanitization. An attacker with repository write access can create a malicious kustomization.yaml file containing a specially crafted chart name to execute arbitrary commands on the host machine running Renovate. **Recommendations** Update Renovate to version 40.33.0 or later.

**Name of the Vulnerable Software and Affected Versions** Renovate versions 35.63.0 through 40.32.0 **Description** A command injection issue exists in the npm manager. This occurs because user-provided `packageName` values are appended to npm install commands without proper sanitization. An attacker with repository write access can create malicious Renovate configuration files to execute arbitrary commands on the system running Renovate. **Recommendations** Update Renovate to version 40.33.0 or later.

**Name of the Vulnerable Software and Affected Versions** Renovate versions 32.135.0 through 40.32.0 **Description** A command injection issue exists in the hermit manager. This occurs because dependency names provided by the user are appended to install and uninstall commands without proper sanitization. An attacker with repository write access can use maliciously named hermit dependencies to execute arbitrary commands on the machine running the software. **Recommendations** Update Renovate to version 40.33.0 or later.

**Name of the Vulnerable Software and Affected Versions** Renovate versions 31.51.0 through 40.32.0 **Description** A command injection issue exists in the helmv3 manager. The `repository` parameter is appended to helm registry login commands without proper sanitization. Attackers with write access to the repository can create malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate. **Recommendations** Update Renovate to version 40.33.0 or later.

**Name of the Vulnerable Software and Affected Versions** Renovate versions 39.53.0 through 40.32.x **Description** A command injection issue exists in the gleam manager. The `depName` parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate. **Recommendations** Update Renovate to version 40.33.0 or later.