An OS command injection vulnerability in Renovate allows unauthenticated attackers to achieve remote code execution, requiring an immediate update to version 37.199.0 or later.

This is an OS command injection vulnerability (CWE-78) occurring when the application processes Helm v3 configurations. The vulnerability is reachable by an unauthenticated attacker, allowing them to inject and execute arbitrary commands on the host running the Renovate bot.

The ability to execute arbitrary OS commands on the host environment provides an attacker with significant leverage, potentially allowing them to steal secrets, modify source code, or pivot into other connected infrastructure. Given the high CVSS score of 8.8, this represents a critical risk to the software supply chain and CI/CD pipeline integrity.

Immediate Action: Update the Renovate package to version 37.199.0 or later to patch the command injection vulnerability.

Proactive Monitoring: Audit CI/CD logs for unexpected shell executions or unusual process activities occurring during the dependency update cycle.

Compensating Controls: Run the Renovate bot within a strictly containerized environment with minimal privileges and restricted outbound network access to limit the potential blast radius of an exploit.

Public Exploit Available: No

Because Renovate is a central component of dependency management, this vulnerability poses a significant risk to the security of the development lifecycle. All users must immediately update to version 37.199.0 to mitigate the risk of remote command execution and ensure the integrity of their automated update processes.