CVE-2026-88889 — Renovate before 44.14.7 Command Injection via distributionType
Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious dis…
Published: 2026-09-10 · CVSS: 8.5 · CVSS 4.0
Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped distributionType values to achieve remote code execution when Renovate processes Maven Wrapper updates in binarySource=docker mode.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7