Renovate before 44.14.7 Command Injection via Mix organization
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in binarySource=docker mode.
CVE-2026-88888
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-88888
renovate
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
renovate-ce
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
renovate-ee-server
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
renovate-ee-worker
Source reference: /containers/cna/affected/3/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
mend-renovate-ce
Source reference: /containers/cna/affected/4/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
mend-renovate-enterprise-edition
Source reference: /containers/cna/affected/5/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "renovatebot",
"product": "renovate",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "44.14.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "44.14.7",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "mend",
"product": "renovate-ce",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "15.4.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.4.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "mend",
"product": "renovate-ee-server",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "15.4.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.4.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "mend",
"product": "renovate-ee-worker",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "15.4.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.4.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "mend",
"product": "mend-renovate-ce",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "15.4.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.4.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "mend",
"product": "mend-renovate-enterprise-edition",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "10.4.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "10.4.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-88888
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #4066 · Revision 1
- Added to Heist Feed
- Publisher date