CyberRota Analysis
AI-GeneratedVersions of Renovate from 32.124.0 to 42.68.5, along with Mend renovate-ce/renovate-ee before 13.3.0, are vulnerable to a command injection flaw during Gradle Wrapper artifact handling. An attacker can exploit this vulnerability by introducing a malicious gradle-wrapper.properties file into a repository, allowing arbitrary command execution within the Renovate runtime, regardless of the allowScripts setting. Organizations using these versions of Renovate should prioritize patching to mitigate the risk of potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url <value>). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled.