Homepage

Command Injection Affecting renovate package, versions >=32.124.0 <42.68.5

Severity

 Recommended
0.0
high
0
10

CVSS assessment by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of Concept

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Command Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JS-RENOVATE-14927386
  • published14 Jan 2026
  • disclosed13 Jan 2026
  • creditseung bin yang
Report a new vulnerability Found a mistake?

Introduced: 13 Jan 2026

New CVE NOT AVAILABLE CWE-78  (opens in a new tab)

How to fix?

Upgrade renovate to version 42.68.5 or higher.

Overview

renovate is a dependency updater.

Affected versions of this package are vulnerable to Command Injection via the distributionUrl parameter in the Gradle Wrapper update process. An attacker can execute arbitrary commands within the runtime environment by injecting shell command substitution syntax into the distributionUrl value into the gradle-wrapper.properties file. This can lead to unauthorized file access, data exfiltration, or modification of resources accessible to the process.

Note:

Users of composer, yarn (v1) or flux managers, should consider upgrading to 42.74.5 (2026-01-08), as there were follow-up fixes to keep these managers working.

PoC

  1. Create a repository with a Gradle Wrapper (gradlew, gradlew.bat, gradle/wrapper/gradle-wrapper.jar, and gradle/wrapper/gradle-wrapper.properties).
  2. Set distributionUrl in gradle-wrapper.properties to include $(...).
  3. Run Renovate against the repository.
  4. Observe that a file is created during Renovate’s wrapper update step before Gradle fails with URISyntaxException.

CVSS Base Scores

version 4.0
version 3.1