renovatebot vulnerabilities

Latest high and critical flaws

• CVE-2026-110868 Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs viHigh 8.4 · Oct 14, 2026
• CVE-2026-110867 Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a sharCritical 9 · Oct 14, 2026
• CVE-2026-110865 Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules heaHigh 7.1 · Oct 14, 2026
• CVE-2026-88889 Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifyinHigh 8.5 · Sep 10, 2026
• CVE-2026-88888 Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameterHigh 7.3 · Sep 10, 2026
• CVE-2026-88887 Renovate is a dependency update automation tool.Critical 9.2 · Sep 10, 2026
• CVE-2026-88886 Renovate is a dependency update automation tool.High 8.5 · Sep 10, 2026
• CVE-2026-88885 Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commaHigh 7.3 · Sep 10, 2026
• CVE-2026-88883 Renovate is an automated dependency update tool.High 8.3 · Sep 10, 2026
• CVE-2026-88882 Renovate is a dependency update automation tool.Critical 9.2 · Sep 10, 2026
• CVE-2026-88881 Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub EnCritical 9.2 · Sep 10, 2026
• CVE-2026-88880 Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-beCritical 9.2 · Sep 10, 2026
• CVE-2026-76233 Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deHigh 8.4 · Aug 19, 2026
• CVE-2026-76232 Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helmHigh 8.4 · Aug 19, 2026
• CVE-2026-76231 Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appendedHigh 8.4 · Aug 19, 2026
• CVE-2026-76230 Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended tHigh 8.4 · Aug 19, 2026
• CVE-2026-76229 Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names areHigh 8.4 · Aug 19, 2026
• CVE-2026-76228 Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artHigh 8.4 · Aug 19, 2026
• CVE-2024-58376 Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers withHigh 8.4 · Aug 19, 2026
• CVE-2020-37267 Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git httpHigh 8.7 · Aug 19, 2026
• CVE-2019-25766 Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios.High 8.7 · Aug 19, 2026