Renovate versions preceding 40.33.0 contain a flaw in the hermit manager where user‑supplied dependency names are appended to shell install or uninstall commands without any sanitization, allowing malicious input to be executed directly by the system. The vulnerability can be leveraged to achieve arbitrary command execution on the host that runs Renovate, giving an attacker full control of that machine. This is a classic command injection weakness (CWE‑77, CWE‑78).

The affected product is renovatebot:renovate, specifically all releases from 32.135.0 up through 40.32.99. Organizations that run Renovate to automate dependency updates and grant write access to contributors or external users are exposed, since the flaw depends on repository‑level permissions to create or modify hermit dependency entries.

The CVSS score of 8.4 classifies the flaw as high severity. EPSS is not disclosed, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits at this time. Based on the description, it is inferred that the attack vector is remote: an attacker must have repository write access to inject a malicious hermit dependency name, a privilege that is commonly granted within development teams. If successful, the attacker can execute arbitrary shell commands on the Renovate host, potentially compromising the entire environment.