PT-2026-78411 · Renovate · Renovate
CVSS v4.0
8.4
High
| Vector | AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Renovate versions 39.218.0 through 40.32.0
Description
The kustomize manager allows arbitrary command injection because user-provided chart names are appended to helm pull commands without proper sanitization. An attacker with repository write access can create a malicious kustomization.yaml file containing a specially crafted chart name to execute arbitrary commands on the host machine running Renovate.
Recommendations
Update Renovate to version 40.33.0 or later.
Exploit
Fix
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Renovate