- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 11 · 9 high, 2 medium
- Weekly downloads
- 559.3K
- Registry
- npm
Advisories 11
- CVE-2026-76233High 8.4
Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager
Affected: from 39.53.0, fixed in 40.33.0.
- CVE-2026-76232High 8.4
Renovate 31.51.0 before 40.33.0 Command Injection via helmv3
Affected: from 31.51.0, fixed in 40.33.0.
- CVE-2026-76231High 8.4
Renovate 32.135.0 before 40.33.0 Command Injection via hermit
Affected: from 32.135.0, fixed in 40.33.0.
- CVE-2026-76230High 8.4
Renovate 35.63.0 before 40.33.0 Command Injection via npm
Affected: from 35.63.0, fixed in 40.33.0.
- CVE-2026-76229High 8.4
Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize
Affected: from 39.218.0, fixed in 40.33.0.
- CVE-2026-76228High 8.4
Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper
Affected: from 32.124.0, fixed in 42.68.5.
- CVE-2026-76227Medium 6.8
Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure
Affected: from 42.68.1, fixed in 42.96.3; from 43.0.0, fixed in 43.4.4.
- CVE-2026-76226Medium 6.8
Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance
Affected: from 43.65.0, fixed in 43.102.11.
- CVE-2024-58376High 8.4
Renovate 37.158.0 before 37.199.0 Command Injection via helmv3
Affected: from 37.158.0, fixed in 37.199.0.
- CVE-2020-37267High 8.7
Renovate 19.180.0 before 23.25.1 Token Leakage via Logs
Affected: from 19.180.0, fixed in 23.25.1.
- CVE-2019-25766High 8.7
Renovate before 19.38.7 Credential Exposure via Go Modules
Affected: from 13.87.0, fixed in 19.38.7.