Executive brief
Renovate is a popular dependency automation tool used to keep software package versions current across projects. When automatically maintaining lock files using Bazel package managers, a vulnerability allows attackers to execute malicious code on the Renovate server if a dependency update contains attacker-controlled content. This could give attackers access to the build system and any credentials or code it has access to.
Technical details
The vulnerability exists in Renovate's lockFileMaintenance feature when using bazel-module or bazelisk managers (versions 43.65.0–43.102.10). The root cause is unsafe execution of Bazel module code that does not properly validate dependencies before passing them to ctx.execute calls. An attacker can craft a malicious dependency package that, when suggested by Renovate as an update, will execute arbitrary code during the bazel mod deps evaluation. The attack requires high privileges (administrator configuration to enable unsafe executions via allowedUnsafeExecutions) but requires no user interaction. The vulnerability is patched in 43.102.11 by adding proper validation and is disabled by default in new deployments.
Affected products
- Renovate renovate 43.65.0 through 43.102.10
Timeline
- 2026-04-16: disclosed: Vulnerability published in GHSA-5vjq-5jmg-39xq
- 2026-04-02: patched: Fix released in version 43.102.11