GHSA-5vjq-5jmg-39xq

Source

https://github.com/advisories/GHSA-5vjq-5jmg-39xq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5vjq-5jmg-39xq/GHSA-5vjq-5jmg-39xq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5vjq-5jmg-39xq

Aliases

CVE-2026-76226

Published

2026-04-16T01:34:39Z

Modified

2026-08-20T04:04:10Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H CVSS Calculator

Summary

Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance

Details

When using lockFileMaintenance using the bazel-module or bazelisk managers between Renovate 43.65.0 (2026-03-12) and 43.102.11 (2026-04-02), there was the opportunity for remote code execution from a malicious dependency, if the Bazel module executes code that relies on a dependency.

As this is an "unsafe" execution path, we have disabled this by default, and self-hosted administrators must add it to the allowedUnsafeExecutions allowlist.

It is recommended to review whether you have enabled this functionality for these managers, and if so, whether any dependency updates may have led to remote code execution.

Impact

If Renovate suggested an update to a malicious dependency, and that dependency is referenced as part of the bazel mod deps call - for instance as part of a ctx.execute call - this would call attacker-controlled code.

This could lead to insider attackers and outside attackers, executing code that is distributed as part of the package.

Patches

This is patched in 43.102.11.

This does not affect any versions of Mend Renovate Self-Hosted.

Workarounds

Upgrade your Renovate version
Disable lockFileMaintenance for these managers

Why did this happen?

This was missed in code review (as part of https://github.com/renovatebot/renovate/pull/41507).

Database specific

{
    "cwe_ids":  [
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-16T01:34:39Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / renovate

Package

Name: renovate; View open source insights on deps.dev
Purl: pkg:npm/renovate

Affected ranges

Type: SEMVER
Events: Introduced

43.65.0

Fixed

43.102.11

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5vjq-5jmg-39xq/GHSA-5vjq-5jmg-39xq.json"