Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
renovate
Vendor
renovatebot
Product
renovate
Platforms
Unknown
Default status
unaffected
renovate · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
44.60.1
Unavailable
None listed
renovate-ce
Vendor
mend
Product
renovate-ce
Platforms
Unknown
Default status
unaffected
renovate-ce · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.5.0
Unavailable
None listed
renovate-ee-server
Vendor
mend
Product
renovate-ee-server
Platforms
Unknown
Default status
unaffected
renovate-ee-server · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.5.0
Unavailable
None listed
renovate-ee-worker
Vendor
mend
Product
renovate-ee-worker
Platforms
Unknown
Default status
unaffected
renovate-ee-worker · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.5.0
Unavailable
None listed
mend-renovate-ce helm chart
Vendor
mend
Product
mend-renovate-ce helm chart
Platforms
Unknown
Default status
unaffected
mend-renovate-ce helm chart · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.5.0
Unavailable
None listed
mend-renovate-enterprise-edition helm chart
Vendor
mend
Product
mend-renovate-enterprise-edition helm chart
Platforms
Unknown
Default status
unaffected
mend-renovate-enterprise-edition helm chart · Scoped product and version facts