Executive brief
Renovate is a popular dependency update automation tool used by development teams to keep package libraries current. In versions before 44.14.7, when Renovate processes private Mix (Elixir) package dependencies in Docker mode, maliciously crafted package names can inject shell commands. An attacker with the ability to commit code to a repository could exploit this to execute arbitrary commands as the Renovate service user, potentially stealing secrets or compromising the build pipeline.
Technical details
The vulnerability is an OS command injection (CWE-78) in Renovate's Mix package manager handler. When authenticating to the Hex registry for private dependencies, the organization parameter is not properly escaped before being passed to shell commands. An attacker can craft a malicious package name (e.g., `private_package:evil --key leaked_or_arbitrary`) that introduces shell metacharacters into the mix hex.organization command. This is only exploitable when binarySource=docker mode is enabled. The attack requires an insider to commit the malicious dependency to the default branch and receive a corresponding dependency update. The vulnerability is patched in Renovate 44.14.7 and corresponding versions of the enterprise editions.
Affected products
- Renovate Renovate before 44.14.7
- Mend Renovate CE before 15.4.0
- Mend Renovate EE Server before 15.4.0
- Mend Renovate EE Worker before 15.4.0
Timeline
- 2026-08-27: disclosed: GitHub Security Advisory GHSA-v85g-rq5w-c46q published
- 2026-09-10: advisory: CVE-2026-88888 assigned; public disclosure
- 2026-09-10: patched: Renovate 44.14.7 and enterprise versions 15.4.0 / 10.4.0 released with fix