CyberRota Analysis
AI-GeneratedRenovate versions prior to 40.33.0 are susceptible to a command injection vulnerability in the helmv3 manager, where unsanitized repository parameters are appended to helm registry login commands. This flaw allows attackers with write access to the repository to execute arbitrary commands by crafting malicious Chart.yaml files, potentially compromising the host machine. Organizations utilizing Renovate for dependency management should prioritize patching to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate.