Description

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-08-19T14:17:50.277Z",
  "pubdate": "2026-08-19T14:17:50.277Z",
  "executiveSummary": "A command injection vulnerability has been identified in the Renovate npm manager, specifically affecting versions from 35.63.0 before 40.33.0. The vulnerability arises due to the insecure handling of user-provided packageName values, which are directly concatenated into internal npm install command strings without adequate sanitization or input validation. This flaw allows malicious actors who possess repository write access to craft and introduce specifically designed Renovate configuration files into a target repository. Successful exploitation of this vulnerability enables the execution of arbitrary operating system commands on the underlying machine or runner executing the Renovate process. The risk implications are severe, as compromised runners often possess elevated privileges, cloud deployment credentials, or access to sensitive internal networks. The primary prerequisites for exploitation include the ability to modify repository configuration files processed by the vulnerable Renovate versions and the subsequent execution of dependency update runs that evaluate the malicious payload.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient input sanitization within the npm manager component of Renovate. Specifically, when processing dependency configurations, user-supplied packageName values are passed unsanitized and appended directly to underlying shell-executed npm install commands. Because the input lacks proper escaping or structural separation from the execution context, specially crafted package names containing shell metacharacters can break out of the intended argument context and inject arbitrary commands into the shell execution stream.\nThe vulnerable component is the npm manager logic responsible for executing package installation routines during dependency update discovery and reconciliation. The affected product version range spans from version 35.63.0 up to, but not including, version 40.33.0.\nThe attack flow proceeds as follows: First, an attacker leverages existing repository write access to modify or create a Renovate configuration file (such as renovate.json) within a targeted repository. Within this configuration, the attacker defines a malicious dependency entry where the packageName parameter is poisoned with a crafted payload containing shell injection operators. Second, the automated or manually triggered Renovate bot scans the repository and parses the malicious configuration file during its execution cycle. Third, when the npm manager attempts to resolve or install the specified dependency, it constructs the npm install command by concatenating the poisoned packageName directly into the command string. Fourth, the operating system executes the resulting command string via a shell, causing the injected shell commands to execute with the privileges and environment of the running Renovate process.\nAuthentication and privilege requirements for initial exploitation necessitate repository write access to supply the malicious configuration. No network exposure or external authentication bypassing is required, as the attack vector is internal to the repository configuration parsing flow. The post-exploitation impact includes arbitrary command execution on the host machine running Renovate, potentially granting the attacker access to environment variables, deployment keys, cloud provider metadata services, and internal network resources accessible from the runner environment."
}