Renovate gomod manager: shell metacharacters in a dependency name run commands as the Renovate user

Impact

Renovate's gomod manager interpolates the depName into the shell command it builds for Go module import-path rewrites without escaping, so a repository whose go.mod names a dependency containing shell metacharacters gets arbitrary commands executed as the Renovate user during a major-version update. On a self-hosted Renovate that services a fleet's repositories, that user typically holds the git credentials and registry tokens for every repo it updates, so code execution there is a path into the CI supply chain for the images and charts a GPU cluster runs. Exploitation needs postUpdateOptions gomodUpdateImportPaths enabled and binarySource=docker. The advisory does not describe a container escape, so the immediate blast radius is the Renovate job and its credentials.

Who can reach it

Anyone who can get a crafted go.mod dependency name into a repository that self-hosted Renovate processes - a contributor, a PR author on a repo Renovate scans, or an upstream module name. No access to the Renovate host itself is needed; the malicious name arrives as repository content.

What to do

Upgrade self-hosted Renovate to 44.14.7 or later and restart the Renovate service or bot container; there is no node-level change and no reboot. If you cannot upgrade immediately, drop gomodUpdateImportPaths from postUpdateOptions, which removes the affected code path. Hosted Renovate (Mend) is updated by the vendor. Rotate the git and registry credentials the Renovate user holds if you have reason to think the flaw was exercised.

References

Related entries

• Renovate Mix manager: unescaped organization parameter lets a package name run commands as the Renovate userCVE-2026-88888 · Renovate (Mix manager, private dependency organization parameter)High
• HPE iLO4 / iLO5: Remote code execution on the management controllerCVE-2018-7078 · HPE iLO4 / iLO5High
• HPE iLO3/4/5: Arbitrary code execution on the iLOCVE-2018-7105 · HPE iLO3/4/5High
• NetApp ONTAP Select Deploy administration utility (privilege escalation): An administrative user of the Deploy utilityCVE-2019-17272 · NetApp ONTAP Select Deploy administration utility (privilege escalation)High
• Ceph MON (CephX authentication): The monitor does not sanitize other_keys when handling CEPHX_GET_AUTH_SESSION_KEY, soCVE-2021-20288 · Ceph MON (CephX authentication)High
• AMD PSP1 Configuration Block (APCB) parsing: An out-of-bounds memory write while the platform processes the AMD PSP1CVE-2021-26344 · AMD PSP1 Configuration Block (APCB) parsingHigh