CVE-2026-88885CWE-78command-injection

CVE-2026-88885

High · published September 10, 2026

CVSS v3.1
7.0
EPSS
1%
Percentile
59.0
In the wild
Unconfirmed
What it is

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary commands as the Renovate user during Go module major version updates with postUpdateOptions gomodUpdateImportPaths enabled.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.3 · CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00889 · 59.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-10T18:17Z
References (2)
https://github.com/renovatebot/renovate/security/advisories/GHSA-mpf8-qxrw-gq3w · [email protected]https://www.vulncheck.com/advisories/renovate-before-44.14.7-command-injection-via-depname · [email protected]
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 1%
    epss
  • 10 SEP 13:05Z
    Renovate before 44.14.7 Command Injection via depName
    cvelistv5