Viceice

**Name of the Vulnerable Software and Affected Versions** Renovate versions 43.65.0 through 43.102.10 **Description** A remote code execution issue exists in the bazel-module and bazelisk managers when the `lockFileMaintenance` feature is enabled. An attacker can execute arbitrary code by supplying malicious dependencies that are subsequently referenced in bazel mod deps calls, specifically within `ctx.execute` statements. **Recommendations** Update Renovate to version 43.102.11 or later.

**Name of the Vulnerable Software and Affected Versions** Renovate versions 42.68.1 through 42.96.2 Renovate versions 42.68.1 through 43.4.3 renovate/renovate versions 13.3.0 through 13.5.9 mend/renovate-ce versions 13.3.0 through 13.5.9 renovate-ee-server versions 13.3.0 through 13.5.9 renovate-ee-worker versions 13.3.0 through 13.5.9 **Description** The software fails to restrict environment variables to an allowlist when spawning child processes, such as `npm install`, `postUpgradeTasks`, and `postUpdateOptions`. This allows child processes to gain full access to all environment variables of the main process, which could enable attackers to exfiltrate secrets accessible to the deployment. **Recommendations** Update Renovate to version 42.96.3 or later. Update Renovate to version 43.4.4 or later. Update Docker images renovate/renovate, mend/renovate-ce, renovate-ee-server, and renovate-ee-worker to version 13.6.0 or later.