Is CVE-2024-58376 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-58376 being exploited in the wild.

How severe is CVE-2024-58376?

Medium severity, with a CVSS score of 6.7, published 19 August 2026.

Which products and versions are affected?

renovate (npm) SEMVER:introduced=37.158.0,fixed=37.199.0.

Is there a fix for CVE-2024-58376?

Yes. renovate (npm): upgrade to 37.199.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-58376 attacked?

It is attacked over the network.

Am I affected by CVE-2024-58376?

Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-58376: Renovate arbitrary command injection via helmv3 registryAliases

CVE-2024-58376 · Severity: medium · CVSS 6.7 · Published 2026-08-19

Renovate is a popular automated dependency management tool used by development teams to keep project dependencies up to date. An attacker with commit access to a repository could inject malicious shell commands through Helm chart configuration, allowing them to execute arbitrary code in Renovate's execution environment (Docker containers, Kubernetes pods, or CI/CD pipelines). This could lead to exposure of credentials, secrets, and access to the underlying infrastructure.

Technologies: renovate (npm). Vendors: npm.

Quick answers

Is CVE-2024-58376 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-58376 being exploited in the wild.
How severe is CVE-2024-58376?: Medium severity, with a CVSS score of 6.7, published 19 August 2026.
Which products and versions are affected?: renovate (npm) SEMVER:introduced=37.158.0,fixed=37.199.0.
Is there a fix for CVE-2024-58376?: Yes. renovate (npm): upgrade to 37.199.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-58376 attacked?: It is attacked over the network.
Am I affected by CVE-2024-58376?: Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

renovate (npm): upgrade to 37.199.0 or later
```
npm install renovate@37.199.0
```

Technical details

The vulnerability is a command injection flaw in the helmv3 manager's handling of registryAliases configuration. The vulnerable code constructs a `helm repo add` command without properly quoting the registry alias key, allowing attackers to inject shell metacharacters and arbitrary commands. The attack requires commit access to the default branch to modify renovate.json or helm chart files. An attacker can execute arbitrary shell commands in Renovate's execution environment by crafting a malicious registryAliases entry (e.g., `"foo/bar || sh -c 'ls /; exit 1'"`) that breaks out of the intended command structure. The vulnerability affects versions 37.158.0 through 37.199.0, with the fix applied in version 37.199.0 using proper shell escaping (shlex quoting).

Affected products

Renovate Renovate 37.158.0 to 37.199.0

Identifiers

CVE-2024-58376
GHSA-rqgv-292v-5qgr

Timeline

2024-04-23: disclosed: GitHub Security Advisory published
2024-04-23: patched: Fixed in version 37.199.0 with shlex quoting

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.