Renovatebot Renovate
10 CVEs affecting Renovatebot Renovate. Latest disclosed: 2026-08-19. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-37267 | High | 7.5 | 2026-08-19 | Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git htt… |
CVE-2019-25766 | High | 7.5 | 2026-08-19 | Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The… |
CVE-2026-76233 | Medium | 6.7 | 2026-08-19 | Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam d… |
CVE-2026-76232 | Medium | 6.7 | 2026-08-19 | Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to hel… |
CVE-2026-76231 | Medium | 6.7 | 2026-08-19 | Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appende… |
CVE-2026-76230 | Medium | 6.7 | 2026-08-19 | Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended… |
CVE-2026-76229 | Medium | 6.7 | 2026-08-19 | Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names ar… |
CVE-2026-76228 | Medium | 6.7 | 2026-08-19 | Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper ar… |
CVE-2026-76226 | Medium | 6.3 | 2026-08-19 | Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintena… |
CVE-2026-76227 | Medium | 5.5 | 2026-08-19 | Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, ren… |