Renovate before 44.61.3 contains a protection mechanism bypass that allows the minimumReleaseAge validation to be skipped when a user requests a pull‑request rebase via the rebase/retry checkbox. By publishing a malicious dependency version, an attacker can have that version inserted into the rebase PR and executed in continuous integration before the required release age has elapsed. This flaw is a form of improper control of system state, classified under CWE‑693 and CWE‑841, and enables the introduction of potentially unsafe code into the build pipeline earlier than intended.

The vulnerability affects the Mend Renovate Continuous Edition Helm chart (mend-renovate-ce), the Mend Renovate Enterprise Edition Helm chart (mend-renovate-enterprise-edition), the Mend Renovate Continuous Edition client (mend:renovate-ce), the Mend Renovate Enterprise Edition server (mend:renovate-ee-server), the Mend Renovate Enterprise Edition worker (mend:renovate-ee-worker), and the core Renovate product (renovatebot:renovate). All versions prior to 44.61.3 are susceptible; no post‑44.61.3 versions are known to be affected.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is <1%, indicating a very low exploitation probability. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector involves an attacker who can introduce or modify a dependency in a repository or have write access to trigger a PR rebase. Once a rebase request is made, the bypass allows the rewritten PR to skip the minimumReleaseAge guard and execute the new dependency in CI, thereby enabling arbitrary code execution within the CI environment before the intended delay.