Executive brief
Renovate is a popular automated dependency update tool used by development teams to keep project libraries current. When Renovate updates Maven Wrapper configurations in certain self-hosted deployment modes, it fails to sanitize malicious input parameters, allowing an attacker to inject arbitrary shell commands and gain code execution on the Renovate server. This could lead to data theft, system compromise, or use of the server for further attacks.
Technical details
This is an OS command injection vulnerability (CWE-78) in Renovate's Maven Wrapper manager component. When Renovate processes maven-wrapper.properties files during Maven Wrapper updates in binarySource=docker mode, it fails to properly escape or validate the distributionType parameter before using it in shell command construction. An attacker can craft a malicious maven-wrapper.properties file in a repository with an injected distributionType value (e.g., "script; cp /etc/passwd /tmp/passwd") that executes arbitrary commands when Renovate processes the wrapper upgrade. The vulnerability requires the target to be running in binarySource=docker self-hosted mode and have access to a malicious repository. The fix is available in Renovate 44.14.7 and corresponding patched versions of commercial distributions.
Affected products
- Renovate Renovate < 44.14.7
- Mend renovate-ce < 15.4.0
- Mend renovate-ee-server < 15.4.0
- Mend renovate-ee-worker < 15.4.0
- Mend mend-renovate-ce < 15.4.0
- Mend mend-renovate-enterprise-edition < 10.4.0
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Patched in Renovate 44.14.7 and Mend Enterprise 15.4.0 / 10.4.0
- 2026-09-10: advisory