PT-2026-78414 · Renovate · Renovate
CVSS v4.0
8.4
High
| Vector | AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Renovate versions 31.51.0 through 40.32.0
Description
A command injection issue exists in the helmv3 manager. The
repository parameter is appended to helm registry login commands without proper sanitization. Attackers with write access to the repository can create malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate.Recommendations
Update Renovate to version 40.33.0 or later.
Exploit
Fix
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Renovate