CVE-2026-88888: Renovate Mix manager command injection via unescaped organization parameter

CVE-2026-88888 · Severity: high · CVSS 7 · Published 2026-09-10

Renovate is a popular dependency update automation tool used by development teams to keep package libraries current. In versions before 44.14.7, when Renovate processes private Mix (Elixir) package dependencies in Docker mode, maliciously crafted package names can inject shell commands. An attacker with the ability to commit code to a repository could exploit this to execute arbitrary commands as the Renovate service user, potentially stealing secrets or compromising the build pipeline.

Technologies: Mend Renovate-Ce, Mend Renovate-Ee-Server, Mend Renovate-Ee-Worker. Vendors: Mend.

Quick answers

Is CVE-2026-88888 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88888 being exploited in the wild.
How severe is CVE-2026-88888?
High severity, with a CVSS score of 7, published 10 September 2026.
Which products and versions are affected?
Mend Renovate-Ce before 15.4.0; Mend Renovate-Ee-Server before 15.4.0; Mend Renovate-Ee-Worker before 15.4.0.
Is there a fix for CVE-2026-88888?
A patch was published on 2026-09-10: Renovate 44.14.7 and enterprise versions 15.4.0 / 10.4.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88888 attacked?
It is attacked with local access.
Am I affected by CVE-2026-88888?
Check whether you run Mend Renovate-Ce, Mend Renovate-Ee-Server or Mend Renovate-Ee-Worker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection (CWE-78) in Renovate's Mix package manager handler. When authenticating to the Hex registry for private dependencies, the organization parameter is not properly escaped before being passed to shell commands. An attacker can craft a malicious package name (e.g., `private_package:evil --key leaked_or_arbitrary`) that introduces shell metacharacters into the mix hex.organization command. This is only exploitable when binarySource=docker mode is enabled. The attack requires an insider to commit the malicious dependency to the default branch and receive a corresponding dependency update. The vulnerability is patched in Renovate 44.14.7 and corresponding versions of the enterprise editions.

Affected products

  • Renovate Renovate before 44.14.7
  • Mend Renovate CE before 15.4.0
  • Mend Renovate EE Server before 15.4.0
  • Mend Renovate EE Worker before 15.4.0

Timeline

  • 2026-08-27: disclosed: GitHub Security Advisory GHSA-v85g-rq5w-c46q published
  • 2026-09-10: advisory: CVE-2026-88888 assigned; public disclosure
  • 2026-09-10: patched: Renovate 44.14.7 and enterprise versions 15.4.0 / 10.4.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.