Description
Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.
Published: 2026-08-19
Score: 9.3 Critical
EPSS: 1.7% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a command injection in Renovate’s helmv3 manager registryAliases handling. Attackers with commit access can craft registryAliases keys containing unquoted shell metacharacters, causing arbitrary commands to run during helm repository addition. This can allow full execution within the Renovate environment, compromising confidentiality, integrity, availability, and potentially the underlying host.

Affected Systems

Affected versions are Renovate 37.158.0 up to, but not including, 37.199.0. The product is Renovate by renovatebot, impacting any deployment of these versions where helm integration is enabled.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity. Attackers require commit-level access to a repository managed by Renovate. The CVE was not listed in the CISA KEV catalog and has an EPSS score of 2%, reflecting a low but nonzero probability of exploitation in the wild. Nonetheless, the ability to inject commands during helm repo addition makes the vulnerability highly exploitable if an attacker can gain commit access.

Generated by OpenCVE AI on August 20, 2026 at 22:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Renovate to version 37.199.0 or later which removes the command injection flaw.
  • Restrict commit rights to trusted users and enforce least privilege on repositories that Renovate services.
  • Ensure all registryAliases values are validated and quoted or removed, audit helm repository configurations for untrusted inputs, and consider disabling helm integration if not required.

Generated by OpenCVE AI on August 20, 2026 at 22:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 05 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 20 Aug 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Renovatebot
Renovatebot renovate
Vendors & Products Renovatebot
Renovatebot renovate

Wed, 19 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Description Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.
Title Renovate 37.158.0 before 37.199.0 Command Injection via helmv3
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Renovatebot Renovate
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-20T15:23:34.198Z

Reserved: 2026-08-16T13:02:14.690Z

Link: CVE-2024-58376

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-19T14:17:16.240

Modified: 2026-08-20T16:17:05.520

Link: CVE-2024-58376

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-19T14:01:49Z

Links: CVE-2024-58376 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T22:30:05Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')