Code Execution Affecting renovate package, versions >=43.65.0 <43.102.11
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-RENOVATE-16083197
- published16 Apr 2026
- disclosed16 Apr 2026
- creditTobias Schlatter
Introduced: 16 Apr 2026
New CVE NOT AVAILABLE CWE-94 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade renovate to version 43.102.11 or higher.
Overview
renovate is a dependency updater.
Affected versions of this package are vulnerable to Code Execution in the via lockfile maintenance in bazel-module/lockfile.ts, used by bazel-module and bazelisk. An attacker can execute arbitrary code by introducing a malicious dependency that is explicitly referenced during a bazel mod deps call, such as through a ctx.execute invocation. This is only exploitable if the allowedUnsafeExecutions configuration is enabled.
Workaround
This vulnerability can be mitigated by disabling lockFileMaintenance for the affected managers.