The vulnerability in Renovate allows digest updates to bypass the configured minimumReleaseAge check. When a repository enables minimumReleaseAge and includes dependencies with updateType=digest, Renovate will still open pull requests for newly published digests. These pull requests receive only a pending stability‑days status check, so CI workflows can run before the intended waiting period. This effectively lets an attacker trigger automated updates that may introduce malicious dependencies into the codebase before proper scrutiny, thereby evading the safeguards intended by minimumReleaseAge.

Versions of Renovate earlier than 44.3.1, Mend Renovate CE/EE images before 15.4.0, the mend-renovate-ce Helm chart before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0 are impacted. All systems using renovatebot:renovate or the corresponding Mend images that do not run a patched release are vulnerable.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited active exploitation evidence. However, the attack scenario requires an attacker who can publish a new digest or control a repository’s configuration to set updateType to digest. By doing so, the attacker can cause automated pull requests and trigger CI pipelines before the required stability period, potentially introducing malicious code. The lack of an existing exploit reduces immediate risk, but the mechanism remains a viable attack vector in environments that rely on the affected tool versions.