CyberRota Analysis
AI-GeneratedA command injection vulnerability exists in Renovate versions prior to 44.14.7, specifically affecting the gomod manager when handling unescaped depName parameters in Docker mode. This flaw allows attackers to inject shell metacharacters via malicious dependency names, potentially executing arbitrary commands as the Renovate user during Go module updates. Organizations utilizing Renovate for Go module management, particularly those with postUpdateOptions enabled, should prioritize patching to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary commands as the Renovate user during Go module major version updates with postUpdateOptions gomodUpdateImportPaths enabled.