Command Injection Vulnerability in Renovate by Renovatebot

CVE-2026-88888

What is CVE-2026-88888?

The Renovate tool, provided by Renovatebot, is susceptible to a command injection vulnerability when handling private dependencies. This risk arises specifically in the Mix manager, where unescaped organization parameters can lead to unauthorized command execution. Attackers can exploit this issue by crafting malicious package names that include shell metacharacters, thereby allowing them to execute arbitrary commands under the context of the Renovate user when the binary source is set to docker mode. It is crucial for users of Renovate before version 44.14.7 to implement safety measures and upgrade to mitigate this risk.

References