What’s Vulnerable › Vulnerabilities

CVE-2026-88889: Renovate before 44.14.7 Command Injection via distributionType

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-10 · updated 2026-09-29
• Weakness: CWE-78

Description

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped distributionType values to achieve remote code execution when Renovate processes Maven Wrapper updates in binarySource=docker mode.

Affected products

• mend-renovate-ce: before 15.4.0 — fixed in 15.4.0
• mend-renovate-enterprise-edition: before 10.4.0 — fixed in 10.4.0
• mend renovate-ce: before 15.4.0 — fixed in 15.4.0
• mend renovate-ee-server: before 15.4.0 — fixed in 15.4.0
• mend renovate-ee-worker: before 15.4.0 — fixed in 15.4.0
• renovatebot renovate: before 44.14.7 — fixed in 44.14.7

How to fix

Upgrade to a fixed version: mend-renovate-ce 15.4.0; mend-renovate-enterprise-edition 10.4.0; mend renovate-ce 15.4.0; mend renovate-ee-server 15.4.0; mend renovate-ee-worker 15.4.0; renovatebot renovate 44.14.7. Check the vendor advisory for mitigations.

References

• https://github.com/renovatebot/renovate/security/advisories/GHSA-f2v7-35mm-3hx7
• https://www.vulncheck.com/advisories/renovate-before-44.14.7-command-injection-via-distributiontype

Get alerted when CVE-2026-88889 or the next vulnerability affects your stack