Executive brief
Renovate is a popular dependency update automation tool used to keep software packages up-to-date. The tool is vulnerable to arbitrary command execution when processing Helm charts via kustomization files, allowing attackers with write access to a monitored repository to execute malicious commands on the machine running Renovate. This could lead to complete compromise of the build/deployment pipeline.
Technical details
This is a command injection vulnerability (CWE-77) in the kustomize manager module where user-provided Helm chart names are appended to helm pull commands without proper shell escaping. The vulnerable code in lib/modules/manager/kustomize/artifacts.ts fails to sanitize the depName argument using shlex.quote() before passing it to the shell. An attacker can craft a malicious kustomization.yaml with a chart name containing shell metacharacters (e.g., "example || kill 1; echo") in conjunction with a crafted Helm repository index to achieve arbitrary command execution. The attack requires write access to a repository configured for Renovate scanning, but no user interaction is needed once the malicious config is in place. This vulnerability affects versions 39.218.0 through 40.32.x, with a patch available in version 40.33.0 and later.
Affected products
- Renovate Renovate 39.218.0 to 40.32.x
Timeline
- 2026-01-13: disclosed: Advisory GHSA-xv56-3wq5-9997 published
- 2026-01-13: patched: Fix available in version 40.33.0 and later