What’s Vulnerable › Vulnerabilities

CVE-2024-58376: Renovate 37.158.0 before 37.199.0 Command Injection via helmv3

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-19 · updated 2026-10-01
• Weakness: CWE-78

Description

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.

Affected products

• renovatebot renovate: from 37.158.0 before 37.199.0 — fixed in 37.199.0

How to fix

Upgrade to a fixed version: renovatebot renovate 37.199.0. Check the vendor advisory for mitigations.

References

• https://github.com/renovatebot/renovate/security/advisories/GHSA-rqgv-292v-5qgr
• https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3

Get alerted when CVE-2024-58376 or the next vulnerability affects your stack