CVE-2024-58376
Renovate 37.158.0 before 37.199.0 Command Injection via helmv3
- State
- Published
- Severity
- 8.4 High
- Published
- Aug 19, 2026
- Updated
- Sep 29, 2026
- Reserved
- Aug 16, 2026
Description
Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.4 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.7 Medium | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
renovaterenovatebot |
|
References
- GitHub Security Advisory (GHSA-rqgv-292v-5qgr)vendor-advisory
- VulnCheck Advisory: Renovate 37.158.0 before 37.199.0 Command Injection via helmv3third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.