Executive brief
Renovate, a popular automated dependency update tool, inadvertently exposed all of its environment variables to child processes (such as npm install and custom post-upgrade tasks). This could allow both internal and external attackers to extract sensitive credentials and API tokens that Renovate uses for repository and dependency management. Organizations using affected versions should rotate all credentials that Renovate has access to.
Technical details
The vulnerability is an improper access control issue (CWE-269) in environment variable handling. Since version 42.68.1 (2025-12-30), Renovate removed filtering that previously restricted child process access to a whitelist of environment variables. This occurred when the codebase migrated to the execa library, whose default behavior extends environment variables rather than overriding them—a change missed during code review. Child processes spawned for tasks like npm install, postUpgradeTasks, and postUpdateOptions now receive all environment variables accessible to the Renovate process. The attack requires local or adjacent access to the child process or the ability to influence its execution (low privilege requirement, no user interaction needed). Patches are available in versions 42.96.3 and 43.4.4.
Affected products
- Renovate Renovate >=42.68.1 <42.96.3, >=43.0.0 <43.4.4
- Mend renovate-ce >=13.3.0 <13.6.0
- Mend renovate-ee-server >=13.3.0 <13.6.0
- Mend renovate-ee-worker >=13.3.0 <13.6.0
Timeline
- 2026-02-13: disclosed: GHSA-8wc6-vgrq-x6cf published
- 2026-02-13: patched: Patches released in 42.96.3 and 43.4.4