CVE-2024-58376

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/renovatebot/renovate/security/advisories/GHSA-rqgv-292v-5qgr
https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3

Configurations

No configuration.

History

01 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Renovate 37.158.0 anteriores a la 37.199.0 contienen una vulnerabilidad de inyección de comandos en el manejo de registryAliases del gestor helmv3 que permite a los atacantes con acceso de confirmación ejecutar comandos arbitrarios. Los atacantes pueden manipular las claves de registryAliases con metacaracteres de shell sin comillas para inyectar comandos ejecutados durante las operaciones de 'helm repo add', obteniendo acceso total al entorno de ejecución de Renovate.

29 Sep 2026, 23:17

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~8.8~~	v2 : unknown v3 : 6.7

Information

Published : 2026-08-19 14:17

Updated : 2026-10-01 23:10

NVD link : CVE-2024-58376

Mitre link : CVE-2024-58376

CVE.ORG link : CVE-2024-58376

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2024-58376", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58376", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-20T13:52:34.194922Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "37.158.0", "lessThan": "37.199.0", "versionType": "semver"}, {"status": "unaffected", "version": "37.199.0", "versionType": "semver"}], "packageURL": "pkg:npm/renovate", "defaultStatus": "unaffected"}]}], "published": "2026-08-19T14:17:16.240", "references": [{"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-rqgv-292v-5qgr", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment."}, {"lang": "es", "value": "Las versiones de Renovate 37.158.0 anteriores a la 37.199.0 contienen una vulnerabilidad de inyecci\u00f3n de comandos en el manejo de registryAliases del gestor helmv3 que permite a los atacantes con acceso de confirmaci\u00f3n ejecutar comandos arbitrarios. Los atacantes pueden manipular las claves de registryAliases con metacaracteres de shell sin comillas para inyectar comandos ejecutados durante las operaciones de 'helm repo add', obteniendo acceso total al entorno de ejecuci\u00f3n de Renovate."}], "lastModified": "2026-10-01T23:10:00.233", "sourceIdentifier": "disclosure@vulncheck.com"}