Description

Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-19T14:17:49.307Z",
  "pubdate": "2026-08-19T14:17:49.307Z",
  "executiveSummary": "A vulnerability exists in Renovate where child processes spawned during dependency updates and task execution fail to restrict environment variables to a predefined allowlist. This security flaw impacts Renovate versions from 42.68.1 before 42.96.3, from 42.68.1 before 43.4.4, and associated Docker images including renovate/renovate, mend/renovate-ce, renovate-ee-server, and renovate-ee-worker versions >=13.3.0 <13.6.0. The vulnerability allows both insider and outside attackers to compromise the confidentiality of sensitive data by exfiltrating secrets accessible to the main Renovate deployment process. When child processes such as npm install, postUpgradeTasks, and postUpdateOptions are invoked, they inherit the complete set of environment variables present in the parent process memory space, exposing API tokens, cloud credentials, and other deployment-level secrets. The risk implications are severe, as successful exploitation results in unauthorized disclosure of sensitive credentials stored within the CI/CD pipeline or deployment environment. Attacker capabilities rely on the ability to influence or execute arbitrary code within child processes, such as introducing malicious dependencies or executing customized upgrade hooks, thereby capturing and transmitting the leaked environment variables to external endpoints.",
  "technicalDetails": "The root cause of the vulnerability lies in the insecure process spawning mechanism utilized by Renovate when executing child processes. Specifically, when spawning external utilities and hooks—such as npm install, postUpgradeTasks, and postUpdateOptions—the application passes the entire parent environment process.env object to the spawned child execution context without sanitization or enforcing an environment variable allowlist. Consequently, any sensitive configuration, authentication token, private registry credential, or cloud provider secret injected into the primary Renovate deployment container or runner is inherently exposed to any executed subprocess. The vulnerable components encompass the process execution abstractions within Renovate versions 42.68.1 up to 42.96.3, 42.68.1 up to 43.4.4, and specific Docker image deployments of renovate/renovate, mend/renovate-ce, renovate-ee-server, and renovate-ee-worker >=13.3.0 <13.6.0. The attack flow proceeds through the following sequence: First, an attacker injects malicious logic into a target repository via a crafted package configuration, dependency, post-upgrade task, or update option script. Second, when Renovate processes the repository, it triggers the execution of child processes to resolve dependencies or run configured hooks. Third, because the child processes inherit all parent environment variables, the malicious payload gains access to critical deployment secrets including deployment keys and API secrets. Fourth, the malicious script executes arbitrary code to read the process.env namespace, serializes the sensitive variables, and exfiltrates the collected secrets over the network to an attacker-controlled infrastructure. This vector requires the execution of untrusted code within the repository's build or update cycle, making it accessible to any actor capable of modifying repository contents or influencing dependency resolution paths."
}