Renovate fails to restrict environment variables to a whitelist when it spawns child processes. As a result, any child such as npm install, post‑upgrade tasks, or post‑update options receives the entire Renovate environment. This grants an attacker—whether insider or external—the ability to read and exfiltrate secrets stored as environment variables. The vulnerability represents an Information Disclosure flaw (CWE‑526).

Vulnerable are Renovatebot’s Renovate releases between 42.68.1 and 42.96.2 as well as between 42.68.1 and 43.4.3. The affected Docker images include renovate/renovate, mend/renovate‑ce, renovate‑ee‑server, and renovate‑ee‑worker with versions 13.3.0 through 13.5.x (i.e., any release newer than 13.3.0 but prior to 13.6.0). Any deployment running these pre‑patched releases may expose all process environment variables to child processes.

The CVSS score of 6.8 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests that this weakness is not yet widely exploited. The flaw is not catalogued in the CISA Known Exploited Vulnerabilities list. Nonetheless, an attacker who can trigger the execution of a child process—such as npm install or a custom post‑upgrade script—can read all environment variables and potentially exfiltrate secrets. The risk to confidentiality is significant but the low EPSS reduces the likelihood of a widespread exploitation incident.