anonhaven

CVE-2026-88886

HIGH CVSS 4.0: 8.5 EPSS 0.16%
Updated Sep 10, 2026
Docker
Parameter Value
CVSS 8.5 (HIGH)
Affected Versions before 44.14.7
Type CWE-78 (OS Command Injection)
Vendor Docker
Public PoC No

Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0), the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository's gradle/wrapper/gradle-wrapper.properties file before invoking the Gradle Wrapper CLI. In self-hosted deployments configured with binarySource=docker and allowedUnsafeExecutions=['gradleWrapper', ...], a repository that supplies a crafted distributionUrl (for example, appending a shell metacharacter and command) can cause arbitrary commands to be executed as the Renovate user when Renovate processes a Gradle Wrapper update.

The issue is fixed in Renovate 44.14.7; as a workaround, remove 'gradleWrapper' from allowedUnsafeExecutions.

Attack Parameters

Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service

CVSS Vector v4.0

Weakness Type (CWE)

CWE-78 OS Command Injection

References 2

https://github.com/renovatebot/renovate/security/advisories/GHSA-7chm-46wx-888m
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/renovate-before-44.14.7-command-injection-…
disclosure@vulncheck.com
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-54248

Docker

6.5

CVE-2026-50025

Docker

6.9

CVE-2026-88889

Docker

8.5

CVE-2026-88888

Docker

7.3

CVE-2026-88887

Docker

9.2