CyberRota Analysis
AI-GeneratedVersions of Renovate from 43.65.0 to 43.102.11 are vulnerable to a remote code execution flaw in the bazel-module and bazelisk managers, specifically when utilizing lockFileMaintenance. This vulnerability allows attackers to execute arbitrary code by injecting malicious dependencies during bazel mod deps calls. Organizations using affected Renovate versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.