Security advisories

medium2026-04-16

Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance

GHSA-5vjq-5jmg-39xq

medium2026-02-13

Child processes spawned by Renovate incorrectly have full access to environment variables

GHSA-8wc6-vgrq-x6cf

medium2026-01-13

Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml file

GHSA-3f44-xw83-3pmg

medium2026-01-13

Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file

GHSA-xjr7-3c3g-m763

medium2026-01-13

Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies

GHSA-36j9-mx87-2cff

medium2026-01-13

Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration

GHSA-fr4j-65pv-gjjj

medium2026-01-13

Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repository

GHSA-xv56-3wq5-9997

medium2026-01-13

Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`

GHSA-pfq2-hh62-7m96

medium2024-04-23

Renovate vulnerable to arbitrary command injection via helmv3 manager and registryAliases

GHSA-rqgv-292v-5qgr

medium2020-09-14

Renovate vulnerable to Azure DevOps token leakage in logs

GHSA-36rh-ggpr-j3gj