Renovate 37.158.0 before 37.199.0 Command Injection via helmv3
Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.
CVE-2024-58376
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-58376
renovate
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "renovatebot",
"product": "renovate",
"versions": [
{
"status": "affected",
"version": "37.158.0",
"lessThan": "37.199.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "37.199.0",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/renovate",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2024-58376
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #4057 · Revision 1
- Added to Heist Feed
- Publisher date