Description
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| renovatebot | renovate | < 44.60.1 | 44.60.1 |
| mend | renovate-ce | < 15.5.0 | 15.5.0 |
| mend | renovate-ee-server | < 15.5.0 | 15.5.0 |
| mend | renovate-ee-worker | < 15.5.0 | 15.5.0 |
| mend | mend-renovate-ce helm chart | < 15.5.0 | 15.5.0 |
| mend | mend-renovate-enterprise-edition helm chart | < 10.5.0 | 10.5.0 |
References
- GitHub Security Advisory (GHSA-6873-xr44-22vm) vendor-advisory
- VulnCheck Advisory: Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset third-party-advisory