Renovate Mix manager: unescaped organization parameter lets a package name run commands as the Renovate user

Impact

The Mix (Elixir) manager passes the organization parameter for private dependencies into a shell command without escaping, so a crafted package name executes arbitrary commands as the Renovate user when binarySource=docker is in use. This is a separate code path from the gomod injection fixed in the same release (CVE-2026-88885) and is reached only by repositories using Mix private dependencies. The consequence is the same: code execution in the context that holds the bot's git and registry credentials, which is the CI path for what a cluster ultimately deploys. The advisory does not claim escape from the Renovate container.

Who can reach it

Anyone who can place a crafted Mix private-dependency package name into a repository that self-hosted Renovate scans. No direct access to the Renovate host is required.

What to do

Upgrade self-hosted Renovate to 44.14.7 or later and restart the bot service or container - the same release that fixes the gomod path, so one upgrade covers both. No node maintenance is involved. Until then, exclude repositories that use Mix private dependencies from Renovate's scope. Rotate the credentials available to the Renovate user if you suspect it was exercised.

References

Related entries

• HPE iLO4 / iLO5: Remote code execution on the management controllerCVE-2018-7078 · HPE iLO4 / iLO5High
• HPE iLO3/4/5: Arbitrary code execution on the iLOCVE-2018-7105 · HPE iLO3/4/5High
• NetApp ONTAP Select Deploy administration utility (privilege escalation): An administrative user of the Deploy utilityCVE-2019-17272 · NetApp ONTAP Select Deploy administration utility (privilege escalation)High
• Ceph MON (CephX authentication): The monitor does not sanitize other_keys when handling CEPHX_GET_AUTH_SESSION_KEY, soCVE-2021-20288 · Ceph MON (CephX authentication)High
• AMD PSP1 Configuration Block (APCB) parsing: An out-of-bounds memory write while the platform processes the AMD PSP1CVE-2021-26344 · AMD PSP1 Configuration Block (APCB) parsingHigh
• Schneider Electric StruxureWare Data Center Expert (V7.9.2 and prior) - network settings endpoint: Code injectionCVE-2023-25549 · Schneider Electric StruxureWare Data Center Expert (V7.9.2 and prior) - network settings endpointHigh