EUVD-2026-62467
GHSA-7g3f-prg4-fg23
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Malicious payload delivered via network package registry (AV:N); non-default allowedUnsafeExecutions config required (AC:H); attacker controls a registry package, not the Renovate host (PR:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.
AnalysisAI
Remote code execution in Renovate's bazel-module and bazelisk managers exposes self-hosted instances running versions 43.65.0 through 43.102.11 to arbitrary code execution triggered by malicious Bazel dependencies. When lockFileMaintenance invokes 'bazel mod deps', dependency-provided code within ctx.execute statements executes directly on the Renovate host - enabling both insider and outsider supply chain attacks against affected configurations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions to be simultaneously present: Renovate version 43.65.0 through 43.102.10 running in self-hosted (open-source) mode; the bazel-module or bazelisk manager configured for one or more repositories; lockFileMaintenance enabled for those managers; bazel-module or bazelisk explicitly listed in the allowedUnsafeExecutions self-hosted configuration key (this is not the default and requires deliberate administrator action); a Bazel module extension in the target repository that calls ctx.execute in a way that references an external dependency; and a malicious version of that dependency reachable from the configured registry. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 6.8 uses AV:L/AC:L/AT:N/PR:H, reflecting a local attack context requiring high-privilege configuration - an administrator must explicitly add bazel-module or bazelisk to the allowedUnsafeExecutions allowlist, a non-default opt-in that the vendor explicitly marks as unsafe. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Renovate to version 43.102.11 or later - vendor-released patch confirmed at 43.102.11 per GHSA-5vjq-5jmg-39xq, which disables the unsafe execution path by default. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection in Renovate's hermit manager (versions 32.135.0 through 40.33.0) allows an attacker with repository wr
Command injection in Renovate's helmv3 manager (versions 31.51.0 through 40.32.x) allows repository contributors with wr
Command injection in Renovate's npm manager (versions 35.63.0 through 40.33.0) allows attackers with repository write ac
Command injection in Renovate's kustomize manager (versions 39.218.0 through 40.33.0) allows repository contributors wit
Command injection in Renovate's gleam manager (versions 39.53.0 through 40.33.0 exclusive) allows attackers with reposit
Command injection in Renovate's Gradle Wrapper update mechanism allows arbitrary code execution inside the Renovate runt
Environment variable exposure in Renovate (versions 42.68.1 through 42.96.3 and 43.0.0 through 43.4.4) leaks the full pr
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today