CVE-2026-110867
Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 44.60.1, 15.5.0, 10.5.0
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.
Affected versions
- renovatebot renovate
fixed in 44.60.1
- mend renovate-ce
fixed in 15.5.0
- mend renovate-ee-server
fixed in 15.5.0
- mend renovate-ee-worker
fixed in 15.5.0
- mend mend-renovate-ce helm chart
fixed in 15.5.0
- mend mend-renovate-enterprise-edition helm chart
fixed in 10.5.0