CyberRota Analysis
AI-GeneratedVersions of Renovate from 35.63.0 to 40.33.0 are vulnerable to a command injection flaw in the npm manager, allowing attackers with repository write access to execute arbitrary commands on the host machine by manipulating user-provided packageName values in configuration files. This vulnerability poses a medium risk, particularly for organizations using Renovate for dependency management, as it could lead to unauthorized command execution and potential system compromise. Users of affected Renovate versions should prioritize patching to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate.