Executive brief
Renovate is a dependency management automation tool used by development teams to automatically update software dependencies across projects. An attacker with write access to a repository can craft a malicious Renovate configuration file that injects arbitrary commands, allowing them to execute code on the machine running Renovate with the privileges of the Renovate process. This enables unauthorized code execution, data theft, or service disruption on build systems and CI/CD infrastructure.
Technical details
This is a command injection vulnerability (CWE-77) in Renovate's npm manager module. The vulnerability exists in lib/modules/manager/npm/post-update/npm.ts, where user-controlled package names and workspace identifiers are concatenated into npm install commands without proper shell escaping. An attacker can craft a malicious renovate.json5 configuration file using the overridePackageName or workspace name parameters to break out of the command context and inject arbitrary shell commands. The attack requires write access to a repository configured for Renovate scanning and high privileges on the Renovate runner. The vulnerability has existed since version 35.63.0 (April 2023) and is fixed in version 40.33.0 and later.
Affected products
- Renovate Renovate >=35.63.0, <40.33.0
Timeline
- 2026-01-13: disclosed: GHSA-fr4j-65pv-gjjj published
- 2026-01-13: patched: Fix released in version 40.33.0