CVE-2026-76227
CVE-2026-76227 · Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, renovate-ee-server, renovate-ee-worker) from 13.3.0 before 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.
CVSS 6.8 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
renovate
- Versions
- ≥ 42.68.1, < 42.96.3: Affected (semver)
- 42.96.3: Not affected (semver)
- ≥ 43.0.0, < 43.4.4: Affected (semver)
- 43.4.4: Not affected (semver)
Update to 42.96.3; Update to 43.4.4
renovate-ce
- Versions
- ≥ 13.3.0, < 13.6.0: Affected (semver)
- 13.6.0: Not affected (semver)
Update to 13.6.0
renovate-ee-server
- Versions
- ≥ 13.3.0, < 13.6.0: Affected (semver)
- 13.6.0: Not affected (semver)
Update to 13.6.0
renovate-ee-worker
- Versions
- ≥ 13.3.0, < 13.6.0: Affected (semver)
- 13.6.0: Not affected (semver)
Update to 13.6.0
renovate npm
- Affected ranges
- SEMVER: ≥ 42.68.1, < 42.96.3
Update to 42.96.3
renovate npm
- Affected ranges
- SEMVER: ≥ 43.0.0, < 43.4.4
Update to 43.4.4