CVE-2026-88888
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in binarySource=docker mode.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.3
- CVSS vector
- CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CWE
- CWE-78
- Published
- 2026-09-10
- Last modified
- 2026-09-10
Affected products
- renovatebot renovate
- renovatebot renovate
- renovatebot renovate
- renovatebot renovate
Weakness type
Related vulnerabilities
- CVE-2026-17176 — OS command injection Vulnerability in Deco BE11000
- CVE-2026-78569 — Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- CVE-2026-78575 — Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- CVE-2026-79724 — Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- CVE-2026-81550 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-82095 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-82098 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-82099 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software