CVE-2026-88885 in Renovate
Summary
by MITRE • 09/10/2026
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary commands as the Renovate user during Go module major version updates with postUpdateOptions gomodUpdateImportPaths enabled.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in versions of Renovate prior to 44.14.7 represents a critical command injection flaw within the gomod manager, specifically triggered when operating in binarySource=docker mode. This security issue arises from insufficient input validation and sanitization mechanisms applied to dependency names during import-path update operations. When the tool processes unescaped depName parameters for Go modules, it fails to properly escape shell metacharacters embedded within these identifiers. Consequently, if an attacker can influence or supply a maliciously crafted dependency name containing shell special characters such as semicolons, pipes, or backticks, they can break out of the intended command context and inject arbitrary commands into the execution pipeline.
The operational impact of this vulnerability is severe because it allows for remote code execution under the privileges of the user running Renovate. This risk materializes primarily during Go module major version updates where postUpdateOptions gomodUpdateImportPaths are enabled, a configuration that instructs Renovate to automatically update import statements in source files to match new package paths. In this scenario, the tool constructs shell commands to execute various operations related to dependency management and code modification. Due to the lack of proper escaping, any special characters present in the depName parameter are interpreted by the underlying operating system's command interpreter rather than being treated as literal string data. This enables an attacker who controls or influences the dependency graph, potentially through a compromised upstream package or a malicious pull request targeting the project, to execute arbitrary commands on the host machine where Renovate is running.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The attack vector leverages the interaction between user-supplied input and system-level command execution without adequate sanitization. In terms of tactical mapping within the MITRE ATT&CK framework, this behavior corresponds to T1059 Command and Scripting Interpreter, specifically involving indirect command invocation through a wrapper or utility like Renovate. The exploitation relies on the principle of least privilege being violated if the service account running Renovate possesses elevated permissions, thereby amplifying the potential damage from simple code execution to full system compromise.
Mitigation strategies must prioritize immediate upgrading to version 44.14.7 or later where these input validation checks have been implemented and shell metacharacters are properly escaped before being passed to the command interpreter. For environments that cannot immediately upgrade, administrators should review their Renovate configurations to ensure that binarySource is not set to docker if alternative execution methods like local binaries can be securely managed with strict sandboxing. Additionally, implementing rigorous input validation on dependency sources and restricting the permissions of the user account executing Renovate commands can significantly reduce the blast radius in case of exploitation. Continuous monitoring for unusual process executions originating from the Renovate service should also be established to detect potential attempts at command injection in real-time.