Executive brief
Renovate, a tool used to automate dependency updates, is vulnerable to remote code execution when managing Bazel-based projects. If a project is configured to use the Bazel or Bazelisk managers with lock file maintenance enabled, a malicious dependency update could trigger the execution of unauthorized code. This could allow an attacker to gain control over the environment where Renovate is running, potentially compromising sensitive build credentials or internal source code.
Technical details
A code injection vulnerability (CWE-94) exists in Renovate's Bazel-related managers. When the 'lockFileMaintenance' feature is enabled for 'bazel-module' or 'bazelisk', Renovate may execute code from a dependency during the 'bazel mod deps' call, specifically through 'ctx.execute'. An attacker who can influence a dependency update (either as an insider or via a compromised upstream package) can achieve arbitrary code execution in the Renovate execution environment. The vulnerability was introduced in version 43.65.0 and is patched in 43.102.11. Self-hosted users can mitigate this by ensuring these managers are not in the 'allowedUnsafeExecutions' list or by disabling 'lockFileMaintenance' for affected managers.
Affected products
- Renovate Bot renovate >= 43.65.0, < 43.102.11
Timeline
- 2026-03-12: other: Vulnerability introduced in version 43.65.0
- 2026-04-02: patched: Fixed in version 43.102.11
- 2026-04-16: advisory: GitHub Advisory published