CyberRota Analysis
AI-GeneratedVersions of Renovate prior to 40.33.0 are vulnerable to a command injection flaw in the gleam manager, where the depName parameter is improperly sanitized. This allows attackers with write access to repositories to create malicious gleam.toml files, potentially executing arbitrary commands on the affected system. Organizations using Renovate should prioritize patching to mitigate the risk of unauthorized command execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate.