The CVE describes a command injection flaw in the handling of Gradle Wrapper artifacts by Renovate. When the tool processes a Gradle Wrapper update it runs a wrapper command via the shell and passes the distributionUrl from gradle‑wrapper.properties unvalidated. If the URL contains shell–command substitution such as $(...), the shell executes it before Gradle sees it, enabling arbitrary commands to run with the Renovate process. This command injection (CWE‑78) can lead to remote code execution on the host where Renovate is running.

Affected are all versions of Renovate from 32.124.0 up to and including 42.68.4, as well as the community edition (renovate‑ce) and enterprise edition (renovate‑ee) before 13.3.0. The vulnerability exists regardless of the allowScripts setting. Users should verify their installed versions against the list and plan upgrades if they fall within the range.

The vulnerability scores a CVSS of 8.4, denoting high severity. EPSS is unavailable and the issue is not listed in CISA’s KEV catalog. Exploitation requires the attacker to introduce a malicious gradle‑wrapper.properties into a repository that Renovate scans, which means the attacker must have write or pull‑request privileges on that repository. Once the file is present, Renovate automatically executes the offending URL via the shell, yielding command execution on the host. Because the flaw occurs during automated update processing and ignore of allowScripts, it can affect all environments where Renovate runs without additional safeguards.