Executive brief
Renovate is a popular dependency automation tool used by development teams to keep software libraries up-to-date. The tool's hermit package manager feature fails to properly sanitize package names, allowing attackers with repository write access to execute arbitrary system commands with the privileges of the Renovate process. This could lead to unauthorized code execution, data theft, or system compromise on machines running the automation tool.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the hermit manager module (lib/modules/manager/hermit/artifacts.ts). User-supplied package names (depName) are concatenated directly into shell commands (./hermit install and ./hermit uninstall) without proper escaping using the shlex.quote() function. This flaw has existed since the hermit manager's introduction in version 32.135.0 (July 2022). A partial fix in version 37.199.1 failed to adequately prevent injection, and the vulnerability was replicated when replacement support was added in version 37.214.4. An attacker with write access to a repository configured for Renovate scanning can craft a malicious hermit dependency name (e.g., "bin/.|| kill 1 ||@0.0.1.pkg") combined with a tweaked renovate.json5 configuration to trigger arbitrary command execution. The PoC demonstrates process termination, but full arbitrary code execution is achievable. The vulnerability requires an attacker with repository write access and affects versions 32.135.0 through 40.32.x; version 40.33.0 and later contain the fix.
Affected products
- Renovate Renovate >=32.135.0, <40.33.0
Timeline
- 2026-01-13: disclosed: GHSA advisory published
- 2026-01-13: patched: Fix released in version 40.33.0