Renovatebot vulnerabilities
25 CVEs and advisories name Renovatebot as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-110868Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources
- CVE-2026-110867Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
- CVE-2026-110866Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request
- CVE-2026-110865Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets
- CVE-2026-88889Renovate before 44.14.7 Command Injection via distributionType
- CVE-2026-88888Renovate before 44.14.7 Command Injection via Mix organization
- CVE-2026-88887Renovate before 44.11.2 Credential Exfiltration via Link Header
- CVE-2026-88886Renovate before 44.14.7 Command Injection via gradle-wrapper
- CVE-2026-88885Renovate before 44.14.7 Command Injection via depName
- CVE-2026-88884Renovate before 44.3.1 Authentication Bypass via Digest Updates
- CVE-2026-88883Renovate before 44.14.4 TLS Private Key Log Sanitisation
- CVE-2026-88882Renovate before 44.11.2 Credential Exfiltration via Link Header
- CVE-2026-88881Renovate before 44.11.3 Credential Exfiltration via Link Header
- CVE-2026-88880Renovate before 44.11.3 Credential Exfiltration via Link Header
- CVE-2026-76233Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager
- CVE-2026-76232Renovate 31.51.0 before 40.33.0 Command Injection via helmv3
- CVE-2026-76231Renovate 32.135.0 before 40.33.0 Command Injection via hermit
- CVE-2026-76230Renovate 35.63.0 before 40.33.0 Command Injection via npm
- CVE-2026-76229Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize
- CVE-2026-76228Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper
- CVE-2026-76227Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure
- CVE-2026-76226Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance
- CVE-2024-58376Renovate 37.158.0 before 37.199.0 Command Injection via helmv3
- CVE-2020-37267Renovate 19.180.0 before 23.25.1 Token Leakage via Logs
- CVE-2019-25766Renovate before 19.38.7 Credential Exposure via Go Modules