CVE-2026-88885 — Renovate before 44.14.7 Command Injection via depName
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySo…
Published: 2026-09-10 · CVSS: 7.3 · CVSS 4.0
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary commands as the Renovate user during Go module major version updates with postUpdateOptions gomodUpdateImportPaths enabled.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7