What’s Vulnerable › Products

renovatebot renovate vulnerabilities

25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 25 published in the last 12 months.

Check whether your renovatebot renovate version is affected

Latest renovatebot renovate vulnerabilities

• CVE-2026-110868 — Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources (CVSS 8.5)
• CVE-2026-110867 — Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset (CVSS 8.5)
• CVE-2026-110866 — Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request (CVSS 4.7)
• CVE-2026-110865 — Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets (CVSS 7.1)
• CVE-2026-88889 — Renovate before 44.14.7 Command Injection via distributionType (CVSS 7.8)
• CVE-2026-88888 — Renovate before 44.14.7 Command Injection via Mix organization (CVSS 7.0)
• CVE-2026-88887 — Renovate before 44.11.2 Credential Exfiltration via Link Header (CVSS 8.6)
• CVE-2026-88886 — Renovate before 44.14.7 Command Injection via gradle-wrapper (CVSS 7.8)
• CVE-2026-88885 — Renovate before 44.14.7 Command Injection via depName (CVSS 7.0)
• CVE-2026-88884 — Renovate before 44.3.1 Authentication Bypass via Digest Updates (CVSS 5.8)
• CVE-2026-88883 — Renovate before 44.14.4 TLS Private Key Log Sanitisation (CVSS 7.7)
• CVE-2026-88882 — Renovate before 44.11.2 Credential Exfiltration via Link Header (CVSS 8.6)
• CVE-2026-88881 — Renovate before 44.11.3 Credential Exfiltration via Link Header (CVSS 8.6)
• CVE-2026-88880 — Renovate before 44.11.3 Credential Exfiltration via Link Header (CVSS 8.6)
• CVE-2026-76233 — Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager (CVSS 6.7)
• CVE-2026-76232 — Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 (CVSS 6.7)
• CVE-2026-76231 — Renovate 32.135.0 before 40.33.0 Command Injection via hermit (CVSS 6.7)
• CVE-2026-76230 — Renovate 35.63.0 before 40.33.0 Command Injection via npm (CVSS 6.7)
• CVE-2026-76229 — Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize (CVSS 6.7)
• CVE-2026-76228 — Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper (CVSS 6.7)
• CVE-2026-76227 — Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure (CVSS 5.5)
• CVE-2026-76226 — Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance (CVSS 6.3)
• CVE-2024-58376 — Renovate 37.158.0 before 37.199.0 Command Injection via helmv3 (CVSS 6.7)
• CVE-2020-37267 — Renovate 19.180.0 before 23.25.1 Token Leakage via Logs (CVSS 7.5)
• CVE-2019-25766 — Renovate before 19.38.7 Credential Exposure via Go Modules (CVSS 7.5)