CVE-2024-58376

Renovate 37.158.0 before 37.199.0 Command Injection via helmv3

Published Aug 19, 2026 CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Description

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.

Analysis

Technical impact

The vulnerability is a command injection in Renovate’s helmv3 manager registryAliases handling. Attackers with commit access can craft registryAliases keys containing unquoted shell metacharacters, causing arbitrary commands to run during helm repository addition. This can allow full execution within the Renovate environment, compromising confidentiality, integrity, availability, and potentially the underlying host.

Affected Systems

Affected versions are Renovate 37.158.0 up to, but not including, 37.199.0. The product is Renovate by renovatebot, impacting any deployment of these versions where helm integration is enabled.

Risk and Exploitability

The CVSS score of 8.4 indicates high severity. Attackers require commit-level access to a repository managed by Renovate. The CVE was not listed in the CISA KEV catalog and has an EPSS score of < 1%, reflecting a low but nonzero probability of exploitation in the wild. Nonetheless, the ability to inject commands during helm repo addition makes the vulnerability highly exploitable if an attacker can gain commit access.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

renovatebot

renovate

unaffected

Version	Status	Constraints
`37.158.0`	affected	< 37.199.0
`37.199.0`	unaffected	—

No data.

Vendor Product Versions

Renovatebot

Renovate

Version	Status	Scheme	Platform
`[37.158.0,37.199.0)`	affected	semver	—
`37.199.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Renovate to version 37.199.0 or later which removes the command injection flaw.
Restrict commit rights to trusted users and enforce least privilege on repositories that Renovate services.
Ensure all registryAliases values are validated and quoted or removed, audit helm repository configurations for untrusted inputs, and consider disabling helm integration if not required.

Generated by OpenCVE AI on October 1, 2026 at 21:47 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.686% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/renovatebot/renovate/security/advisories/GHSA-rqgv-292v-5qgr
https://nvd.nist.gov/vuln/detail/CVE-2024-58376
https://www.cve.org/CVERecord?id=CVE-2024-58376
https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3

History

Oct 1, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 29, 2026 10:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`	cvssV3_1 `{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Sep 5, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2024-58376 https://www.cve.org/CVERecord?id=CVE-2024-58376
Metrics	threat_severity `None`	threat_severity `Important`

Aug 20, 2026 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Renovatebot Renovatebot renovate
Vendors & Products		Renovatebot Renovatebot renovate

Aug 19, 2026 2:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.
Title		Renovate 37.158.0 before 37.199.0 Command Injection via helmv3
Weaknesses		CWE-78
References		https://github.com/renovatebot/renovate/security/advisories/GHSA-rqgv-292v-5qgr https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`