The vulnerability is an OS command injection in the lockFileMaintenance manager of Renovate. An attacker who can influence the dependencies referenced in bazel mod deps calls can execute arbitrary ctx.execute statements, allowing the execution of arbitrary code on the system where Renovate runs. Because this occurs during lock file maintenance, it can affect all repositories managed by the affected Renovate instance, potentially compromising confidentiality, integrity, and availability of the environment.

Instances of Renovate produced by Renovatebot, specifically versions 43.65.0 through 43.102.10, are affected. These releases include the bazel-module and bazelisk managers that are vulnerable. Versions above 43.102.10 are not impacted, as the fix has been applied.

The CVSS score of 6.8 indicates medium severity, and the exploitation probability (EPSS) is not publicly available, so the likelihood cannot be precisely quantified but the vulnerability is known to be exploitable. It is not listed in CISA KEV. Attackers with the ability to supply or modify lock files or configuration for the Renovate instance can trigger the vulnerability, resulting in remote code execution.