Renovate does not filter environment variables when it spawns child processes such as npm install, post‑upgrade tasks, or custom scripts. Because it passes the full set of process environment variables to these children, secrets held by the Renovate deployment can be read by the child processes. The flaw is a classic information‑disclosure weakness exposed through environment variable leakage (CWE‑526).

Vulnerable are Renovatebot’s Renovate releases between 42.68.1 and 42.96.2 as well as between 42.68.1 and 43.4.3. The affected Docker images include renovate/renovate, mend/renovate‑ce, renovate‑ee‑server, and renovate‑ee‑worker with versions 13.3.0 through 13.5.x (i.e., any release newer than 13.3.0 but prior to 13.6.0). Any deployment running these pre‑patched releases may expose all process environment variables to child processes.

The CVSS score of 6.8 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests that this weakness is not yet widely exploited. The flaw is not catalogued in the CISA Known Exploited Vulnerabilities list. Nonetheless, an attacker who can trigger the execution of a child process—such as npm install or a custom post‑upgrade script—can read all environment variables and potentially exfiltrate secrets. The risk to confidentiality is significant but the low EPSS reduces the likelihood of a widespread exploitation incident.