Renovate versions between 35.63.0 and 40.33.0 allow an attacker to inject arbitrary shell commands by supplying a crafted packageName value that is concatenated directly into an npm install command without any sanitization. This flaw can result in the execution of any commands on the host where Renovate runs, compromising confidentiality, integrity, and availability of the repository server. The vulnerability is a classic command injection (CWE‑77).

The affected product is Renovate by renovatebot, specifically all releases from 35.63.0 up to and including 40.32.x. The vulnerable npm manager code is present in these versions, while 40.33.0 and later include the fix.

The CVSS score of 8.4 indicates a high severity vulnerability. The EPSS score is 0.0073 (0.73%) but because the flaw requires repository-write access and the ability to influence Renovate’s configuration, the likelihood is moderate if such access is granted. The vulnerability is not listed in CISA KEV, so no known active exploitation is documented. Attackers with write permissions to a repository can create a malicious Renovate configuration file that triggers the injection, forcing the host to execute arbitrary commands.