Description

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-08-19T14:17:50.453Z",
  "pubdate": "2026-08-19T14:17:50.453Z",
  "executiveSummary": "A command injection vulnerability exists within the hermit manager of Renovate versions from 32.135.0 before 40.33.0. This flaw allows malicious actors with repository write access to execute arbitrary system commands on the machine executing Renovate. The vulnerability stems from the improper sanitization of user-provided dependency names, which are directly concatenated into underlying install and uninstall execution strings. Successful exploitation leads to unauthorized code execution within the context of the running Renovate process, posing a severe risk to pipeline integrity and host system security. Remediation requires updating the affected software to the patched version where input sanitization or safe execution abstractions are properly enforced.",
  "technicalDetails": "The vulnerability is classified as a command injection flaw localized within the hermit manager component of Renovate versions from 32.135.0 before 40.33.0. The root cause of the issue is the insecure handling of external input, specifically user-provided dependency names, which are appended directly to command-line execution strings for install and uninstall operations without adequate sanitization, validation, or the use of argument-array parameters.\nThe attack flow proceeds when an attacker with repository write access crafts a maliciously named hermit dependency within the target repository configuration or manifest files. When Renovate processes the repository and invokes the hermit manager to handle dependencies, it evaluates the malicious input string. Because the dependency name lacks proper escaping or sanitization, shell metacharacters embedded within the crafted dependency name are interpreted by the underlying command interpreter.\nThis injection allows the attacker to break out of the intended argument context and append arbitrary operating system commands. These injected payloads execute synchronously with the privileges of the user running the Renovate process. Depending on the environment architecture, post-exploitation impact can range from the exfiltration of sensitive environment variables and CI/CD secrets to lateral movement within the build infrastructure and complete compromise of the runner host."
}