Renovate Configuration Preset Allowlist Bypass

Renovate versions prior to 44.60.1 contain an allowlist bypass vulnerability within its configuration preset system. An attacker who controls an externally sourced preset can override restricted environment variables such as PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO. This vulnerability is particularly dangerous for self-hosted Renovate instances where the software executes child processes to perform dependency management and dependency updates. By injecting malicious configuration, an attacker can manipulate the execution environment of these child processes, resulting in arbitrary code execution on the underlying host. The flaw arises from improper validation of preset contents, allowing arbitrary environment variable injection that bypasses existing security restrictions designed to prevent such modifications.