Skip to content
Threat Feed
Subscribe

Vendor

Mend

2 briefs RSS
high advisory

Renovate Configuration Preset Allowlist Bypass

An allowlist bypass in Renovate versions prior to 44.60.1 enables attackers to inject restricted environment variables via malicious configuration presets, leading to arbitrary code execution in child processes.

Renovate supply-chain ci-cd code-execution
2t 1c
high advisory

Credential Disclosure in Renovate via Malicious Pagination Links

Renovate improperly validates HTTP 'Link' headers during GitHub API interactions, allowing a compromised GitHub server to exfiltrate configured credentials by redirecting pagination requests to an attacker-controlled host.

Renovate +5 credential-access supply-chain vulnerability supply-chain-security credential-theft nuget dependency-management
1t 1c