CyberRota Analysis
AI-GeneratedDocker users utilizing Renovate versions prior to 44.14.7 are vulnerable to a command injection flaw in the Mix manager, allowing attackers to exploit unescaped organization parameters in private dependencies. This vulnerability enables the execution of arbitrary commands as the Renovate user, posing a significant risk to system integrity. Organizations relying on Renovate for dependency management should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in binarySource=docker mode.