PT-2026-89396

CVE-2026-88885

Published

2026-09-10

Updated

2026-09-18

Description by

CVSS 4.0

7.3

High

MetricsAV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.14.7

Description A command injection issue exists in the gomod manager when processing unescaped depName parameters during import-path update commands while operating in binarySource=docker mode. This occurs during Go module major version updates when postUpdateOptions gomodUpdateImportPaths is enabled, allowing attackers to inject shell metacharacters via malicious dependency names to execute arbitrary commands as the Renovate user.

Recommendations Update to version 44.14.7 or later. As a temporary mitigation, disable the postUpdateOptions gomodUpdateImportPaths option.

Exploitability

Exploit

Fix

Impacts

Researchers

Iaohkut-From-Nightwolf-Team

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers