CVE-2026-88889: Renovate before 44.14.7 Command Injection via distributionType
Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped distributionType values to achieve remote code execution when Renovate processes Maven Wrapper updates in binarySource=docker mode.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 44.14.7Patch Renovate before 44.14.7 Command Injection via distributionType - Configuration
If you use Renovate in binarySource=docker mode with Maven Wrapper updates, ensure the maven-wrapper.properties distributionType value cannot be set to a malicious parameter by an attacker, since this parameter enables command injection leading to remote code execution.
Renovate Maven Wrapper manager distributionType (maven-wrapper.properties) = use only trusted/expected values (ensure it is not attacker-controlled)
Event History
Frequently Asked Questions
Which Renovate deployments are exposed to this issue?
Deployments running Renovate before 44.14.7 are affected when they process Maven Wrapper updates with binarySource=docker mode. The vulnerable component is the Maven Wrapper manager.
What does an attacker need to control to exploit it?
An attacker needs to supply a malicious distributionType value in maven-wrapper.properties that Renovate processes. The value can contain unescaped shell commands.
What is the impact if exploitation succeeds?
Successful exploitation allows arbitrary command execution, resulting in remote code execution in the context where Renovate processes the Maven Wrapper update.