p PatchFirst

CVE-2024-58376

CVE-2024-58376 · Renovate 37.158.0 before 37.199.0 Command Injection via helmv3

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.

CVSS 8.4 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • renovate

    Versions
    • ≥ 37.158.0, < 37.199.0: Affected (semver)
    • 37.199.0: Not affected (semver)

    Update to 37.199.0

  • renovate npm

    Affected ranges
    • SEMVER: ≥ 37.158.0, < 37.199.0

    Update to 37.199.0

Original sources

Check your server →