Description

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yaml files with specially crafted chart names to execute arbitrary commands on the Renovate host machine.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-08-19T14:17:50.133Z",
  "pubdate": "2026-08-19T14:17:50.133Z",
  "executiveSummary": "An arbitrary command injection vulnerability exists within the Renovate kustomize manager, specifically affecting versions from 39.218.0 before 40.33.0. The vulnerability stems from improper sanitization of user-provided chart names, which are unsafely appended directly to underlying helm pull commands. Successful exploitation allows an authenticated attacker with repository write access to execute arbitrary commands on the host machine hosting the Renovate execution environment. The primary risk implication is complete compromise of the underlying host operating system and execution context. Exploitation requires the attacker to possess repository write access to craft and commit malicious configuration files containing specially crafted chart names. Systems running the specified vulnerable versions of Renovate that process untrusted or attacker-controlled repositories are at direct risk.",
  "technicalDetails": "The vulnerability resides in the kustomize manager component of Renovate, specifically within versions 39.218.0 up to, but not including, 40.33.0. The root cause of the vulnerability is insufficient input sanitization and validation of user-provided data, specifically chart names defined within kustomization.yaml files. When the kustomize manager processes these configuration files, it extracts the user-provided chart names and concatenates them directly into shell commands used to execute the helm pull utility. Because the input lacks proper escaping or parameterization, an attacker can inject arbitrary shell metacharacters, command separators, or flags into the chart name string. The exploitation method requires the adversary to possess repository write access, allowing them to introduce a maliciously crafted kustomization.yaml file into a target repository monitored or processed by Renovate. The step-by-step attack flow begins with the attacker committing the crafted configuration file containing the command injection payload within the chart name parameter. Subsequently, when Renovate initiates dependency updates and invokes the kustomize manager, the vulnerable code path constructs the system execution command by appending the malicious chart name string. The operating system shell evaluates the concatenated command string, executing the attacker's injected commands within the security context and privilege level of the running Renovate host process. Depending on the environment, post-exploitation impact includes unauthorized execution of system binaries, data exfiltration, manipulation of internal build artifacts, lateral movement within the network infrastructure, and complete host machine takeover. Authentication and privilege requirements mandate that the attacker has write access to the targeted repository processed by the affected Renovate instance."
}