The vulnerability occurs in the gomod manager component of Renovate when it processes dependency names that are not properly escaped. A malicious dependency name can contain shell metacharacters, allowing an attacker to inject arbitrary shell commands. When a Go module major version update is performed with the 'gomodUpdateImportPaths' post‑update option enabled, the injected commands run with the privileges of the Renovate process, leading to potential alteration of source code, deployment of malicious artifacts, or further compromise of the system where Renovate operates. The weakness corresponds to CWE‑78, and the CVSS score of 7.3 reflects the high potential for code execution. The impact is therefore the execution of arbitrary commands on the host system in the context of the Renovate service, which could elevate an attacker’s foothold or allow tampering with CI/CD pipelines. The CVSS score of 7.3 indicates a high severity, and though the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, the static analysis and the nature of the attack vector make it a significant risk for projects that run Renovate without proper input sanitization.

The affected system is the Renovate Bot application (renovatebot:renovate). All releases prior to version 44.14.7 are vulnerable when the gomod manager is configured with binarySource=docker and postUpdateOptions includes gomodUpdateImportPaths. Projects that rely on these settings for automatic Go module updates are at risk, especially if the deployment environment runs Renovate with elevated privileges or accesses public repositories where an attacker can influence dependency names. No other vendors or products are indicated. The issue is specific to the open‑source Renovate codebase.

Given the lack of an EPSS score, the likelihood of exploitation cannot be quantified, but the attack scenario is plausible: an attacker submits a malicious dependency name that is later processed during a major version bump. The vulnerability can be exercised remotely through the dependency update workflow, potentially by injecting a payload via a pull request or a package registry trick. Because the command executes as the Renovate user, the attack surface is high for local accounts that own that user. The absence of a KEV listing suggests no widespread exploitation is currently documented, yet the high CVSS score calls for precautionary action.