Renovatebot vulnerabilities
We track 12 vulnerabilities in Renovatebot products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest Renovatebot vulnerabilities
- 8.5 High severity
renovate: Server-Side Request Forgery
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service
- 8.5 High severity
renovate: Incorrect Authorization
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_P
- 7.1 High severity
renovate: Improper Protection of Alternate Path
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalid
- 7.8 High severity
renovate: Improper Neutralization of Special Elements used in an OS Command
Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell com
- 7.0 High severity
renovate: Improper Neutralization of Special Elements used in an OS Command
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary co
- 8.6 High severity
renovate: URL Redirection to Untrusted Site
Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without v
- 7.8 High severity
renovate: Improper Neutralization of Special Elements used in an OS Command
Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0), the manager/gradle-wrapper module does not escape the distr
- 7.0 High severity
renovate: Improper Neutralization of Special Elements used in an OS Command
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious depen
- 7.7 High severity
renovate: Insertion of Sensitive Information into Log File
Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0), log sanitisation for TLS private keys used for Mutual TLS was incomple
- 8.6 High severity
renovate: URL Redirection to Untrusted Site
Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0), when listing new package versions from a NuGet registry Renova
- 8.6 High severity
renovate: URL Redirection to Untrusted Site
Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to t
- 8.6 High severity
renovate: URL Redirection to Untrusted Site
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing