CVE-2026-88885: Renovate before 44.14.7 Command Injection via depName
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary commands as the Renovate user during Go module major version updates with postUpdateOptions gomodUpdateImportPaths enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Renovateto a version that resolves this vulnerability.Fixed in 44.14.7
Event History
Frequently Asked Questions
Which Renovate configurations are exposed?
The vulnerable path requires the gomod manager, binarySource=docker mode, Go module major version updates, and postUpdateOptions with gomodUpdateImportPaths enabled. The issue is triggered when Renovate processes an unescaped depName in an import-path update command.
What does an attacker need to exploit this?
An attacker needs to cause Renovate to process a malicious dependency name containing shell metacharacters in the affected update flow. Successful exploitation executes arbitrary commands with the permissions of the Renovate user.
How can I determine whether my deployment is affected?
Check whether Renovate is earlier than 44.14.7 and whether its configuration uses the gomod manager with binarySource=docker, gomodUpdateImportPaths, and major Go module updates. Deployments not using that combination are not described as reaching the vulnerable command path.