Renovate before 44.60.1 contains an allowlist bypass that lets repositories set restricted environment variables by placing env inside a shared preset. This can override critical values such as PATH, LD_PRELOAD, NODE_OPTIONS, and GIT_SSL_CAINFO in child processes, enabling an attacker to manipulate the runtime environment and potentially execute unauthorized code or alter configuration. The weakness is rooted in improper access control (CWE-863), allowing an entity that controls an externally sourced preset to influence environment variable values that were otherwise intended to be restricted. If exploited, the attacker can affect any process spawned by Renovate, leading to privilege escalation or execution of malicious payloads within the self‑hosted instance.

This vulnerability affects installations of Renovate with versions prior to 44.60.1 across several distributions, including the mend‑renovate‑ce Helm chart, the mend‑renovate‑enterprise‑edition Helm chart, renovate‑ce, renovate‑ee‑server, renovate‑ee‑worker, and the renovatebot:renovate package. All affected releases are those running a pre‑44.60.1 version, regardless of deployment method, whether community edition, enterprise edition, or Helm chart.

The CVSS score of 9 indicates critical severity. EPSS is not available, but the lack of a KEV listing suggests no publicly known exploits yet. The likely attack vector is an attacker who can supply or influence an externally sourced shared preset on a self‑hosted instance. By inserting the preset containing the env override, the attacker can change environment variables for downstream processes, potentially leading to arbitrary code execution or privilege escalation. No additional system compromises beyond the affected processes are required.