Description
Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped distributionType values to achieve remote code execution when Renovate processes Maven Wrapper updates in binarySource=docker mode.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| renovatebot | renovate | < 44.14.7 | 44.14.7 |
| mend | renovate-ce | < 15.4.0 | 15.4.0 |
| mend | renovate-ee-server | < 15.4.0 | 15.4.0 |
| mend | renovate-ee-worker | < 15.4.0 | 15.4.0 |
| mend | mend-renovate-ce | < 15.4.0 | 15.4.0 |
| mend | mend-renovate-enterprise-edition | < 10.4.0 | 10.4.0 |
References
- GitHub Security Advisory (GHSA-f2v7-35mm-3hx7) vendor-advisory
- VulnCheck Advisory: Renovate before 44.14.7 Command Injection via distributionType third-party-advisory