Description

Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-19T14:17:49.157Z",
  "pubdate": "2026-08-19T14:17:49.157Z",
  "executiveSummary": "A remote code execution vulnerability exists in the Renovate dependency management tool, specifically affecting the bazel-module and bazelisk managers when utilizing the lockFileMaintenance feature. The vulnerability arises from the insecure handling of malicious dependencies during dependency resolution and lock file updates. Successful exploitation allows an attacker to execute arbitrary code within the context of the running Renovate process. This poses a severe risk to development pipelines, continuous integration systems, and host infrastructure where Renovate is deployed. The attacker capability includes arbitrary command execution on the host system, which can lead to complete compromise of the build environment, secret exfiltration, or supply chain poisoning. Exploitation typically requires the attacker to introduce a malicious dependency into a target repository that is subsequently processed by Renovate during automated lockFileMaintenance routines, prompting the execution of vulnerable underlying system calls.",
  "technicalDetails": "The vulnerability resides in the bazel-module and bazelisk managers of Renovate, specifically impacting versions from 43.65.0 before 43.102.11. The root cause stems from how Renovate processes external dependencies and interacts with Bazel module dependency commands during automated dependency updates and maintenance tasks like lockFileMaintenance. Specifically, the execution flow improperly sanitizes or handles untrusted inputs derived from dependency definitions when invoking underlying system commands, such as ctx.execute statements, during bazel mod deps calls. The attack flow proceeds as follows: First, an attacker publishes a maliciously crafted dependency containing exploit payloads designed to interact with the Bazel module evaluation phase. Second, a target repository integrates this malicious dependency or references it within its module configuration files. Third, when the automated Renovate bot initiates lockFileMaintenance or processes updates for the bazel-module or bazelisk managers, it evaluates the dependency tree and invokes the vulnerable Bazel commands. Fourth, the malicious input is passed into execution contexts like ctx.execute, causing the host system to interpret the malicious data as executable shell commands or code arguments. Consequently, this leads to unauthorized remote code execution on the machine hosting the Renovate process. The vulnerability affects unauthenticated remote execution paths triggered via repository content processing, requiring no prior user authentication to the Renovate application itself, provided the bot automatically or manually processes the compromised repository."
}