renovate
44.239.1Home of the Mend Renovate CLI: Cross-platform Dependency Automation by Mend.io
- Maintenance
- Active1681 commits in 3 months · bus factor 2
- License
- AGPL-3.0Copyleft · OSI-approved
- Security
- 25 advisories1 critical, 12 high, 12 medium · Scorecard 6.7/10
- Supported versions
- 1 line supportednewest 44 · 4 ended
23.1k stars · 3.4k forks · 1.5k open issues · last release 1 day ago · data checked 4 hours ago
Security advisories
All advisories on GitHubThe 25 most recent advisories published by the maintainers: 1 critical, 12 high, 12 medium. Check the patched version against the one you run.
- mediumCVE-2026-110866Sep 29, 2026A user's request to rebase a PR can bypass strict `minimumReleaseAge` internal checks
- Affected
- <44.61.3; <15.5.0; <10.5.0
- Patched in
- 44.61.3; 15.5.0; 10.5.0
- highCVE-2026-110868Sep 29, 2026Server-Side Request Forgery via HTTP preset URLs in `extends` array or `customDatasources`
- Affected
- <44.79.0; <15.6.0; <10.6.0
- Patched in
- 44.79.0; 15.6.0; 10.6.0
- highCVE-2026-110865Sep 29, 2026HTTP header allowlist (`allowedHeaders`) could be bypassed by using a shared preset
- Affected
- <44.60.1; <15.5.0; <10.5.0
- Patched in
- 44.60.1; 15.5.0; 10.5.0
- criticalCVE-2026-110867Sep 29, 2026Environment variable allowlist (`allowedEnv`) could be bypassed by using a shared preset
- Affected
- <44.60.1; <15.5.0; <10.5.0
- Patched in
- 44.60.1; 15.5.0; 10.5.0
- highCVE-2026-88883Aug 27, 2026TLS private keys were previously not sanitised in logs
- Affected
- <44.14.44; <15.4.0; <10.4.0
- Patched in
- 44.14.4; 15.4.0; 10.4.0
- highCVE-2026-88880Aug 27, 2026Malicious GitLab servers could send a malicious `Link` header to allow exflitrating credentials
- Affected
- <44.11.3; <15.4.0; <10.4.0
- Patched in
- 44.11.3; 15.4.0; 10.4.0
- highCVE-2026-88881Aug 27, 2026Malicious GitHub servers could send a malicious `Link` header to allow exflitrating credentials
- Affected
- <44.11.3; <15.4.0; <10.4.0
- Patched in
- 44.11.3; 15.4.0; 10.4.0
- highCVE-2026-88882Aug 27, 2026Malicious Nuget registries could send a malicious `Link` header to allow exflitrating credentials
- Affected
- <44.11.2; <15.4.0; <10.4.0
- Patched in
- 44.11.2; 15.4.0; 10.4.0
- highCVE-2026-88887Aug 27, 2026Malicious Docker registries could send a malicious `Link` header to allow exflitrating credentials
- Affected
- <44.11.2; <15.4.0; <10.4.0
- Patched in
- 44.11.2; 15.4.0; 10.4.0
- highCVE-2026-88888Aug 27, 2026`manager/mix`: Command injection could be possible via unescaped `organization`
- Affected
- <44.14.7; <15.4.0; <10.4.0
- Patched in
- 44.14.7; 15.4.0; 10.4.0
- highCVE-2026-88889Aug 27, 2026`manager/maven-wrapper`: Command injection could be possible via unescaped `distributionType`
- Affected
- <44.14.7; <15.4.0; <10.4.0
- Patched in
- 44.14.7; 15.4.0; 10.4.0
- highCVE-2026-88886Aug 27, 2026`manager/gradle-wrapper`: Command injection could be possible via unescaped `distributionUrl`
- Affected
- <44.14.7; <15.4.0; <10.4.0
- Patched in
- 44.14.7; 15.4.0; 10.4.0
- highCVE-2026-88885Aug 27, 2026`manager/gomod`: Command injection could be possible via unescaped `depName` in import-path update command
- Affected
- <44.14.7; <15.4.0; <10.4.0
- Patched in
- 44.14.7; 15.4.0; 10.4.0
- mediumCVE-2026-88884Aug 27, 2026Digest updates can bypass strict `minimumReleaseAge` internal checks
- Affected
- <44.3.1; <15.4.0; <10.4.0
- Patched in
- 44.3.1; 15.4.0; 10.4.0
- mediumCVE-2026-76226Apr 14, 2026Remote code execution was possible using the bazel-module or bazelisk managers, when using `lockFileMaintenance`
- Affected
- >=43.65.0
- Patched in
- 43.102.11
- mediumCVE-2026-76227Feb 13, 2026Child processes spawned by Renovate incorrectly have full access to environment variables
- Affected
- >=42.68.1 <42.96.3; >=42.68.1 <43.4.4; >=13.3.0 <13.6.0
- Patched in
- 42.96.3; 43.4.4; 13.6.0
- mediumCVE-2026-76233Jan 13, 2026Arbitrary command injection via gleam manager and malicious gleam.toml file
- Affected
- >= 39.53.0 < 40.33.0
- Patched in
- >= 40.33.0
- mediumCVE-2026-76232Jan 13, 2026Arbitrary command injection via helmv3 manager and malicious Chart.yaml file
- Affected
- >= 31.51.0 < 40.33.0
- Patched in
- >= 40.33.0
- mediumCVE-2026-76231Jan 13, 2026Arbitrary command injection via hermit manager and maliciously named dependencies
- Affected
- >= 32.135.0 < 40.33.0
- Patched in
- >= 40.33.0
- mediumCVE-2026-76230Jan 13, 2026Arbitrary command injection via npm manager and malicious Renovate configuration
- Affected
- >= 35.63.0 < 40.33.0
- Patched in
- >= 40.33.0
- mediumCVE-2026-76229Jan 13, 2026Arbitrary command injection via kustomize manager and malicious helm repository
- Affected
- >= 39.218.0 < 40.33.0
- Patched in
- >= 40.33.0
- mediumCVE-2026-76228Jan 13, 2026Arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`
- Affected
- >=32.124.0 <42.68.5; < 13.3.0
- Patched in
- 42.68.5; 13.3.0
- mediumCVE-2024-58376Apr 23, 2024Arbitrary command injection via helmv3 manager and registryAliases
- Affected
- >= 37.158.0 < 37.199.0
- Patched in
- 37.199.0
- mediumCVE-2020-37267Sep 12, 2020Azure DevOps token leakage in logs
- Affected
- >=19.180.0 <23.25.1
- Patched in
- 23.25.1
- highCVE-2019-25766Oct 18, 2019Go Modules Vulnerability Disclosure
- Affected
- >= 13.87.0 <= 19.38.6
- Patched in
- 19.38.7