CVE-2026-88888CWE-78command-injection

CVE-2026-88888

High · published September 10, 2026

CVSS v3.1
7.0
EPSS
1%
Percentile
59.0
In the wild
Unconfirmed
What it is

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in binarySource=docker mode.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.3 · CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00889 · 59.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-10T18:17Z
References (2)
https://github.com/renovatebot/renovate/security/advisories/GHSA-v85g-rq5w-c46q · [email protected]https://www.vulncheck.com/advisories/renovate-before-44.14.7-command-injection-via-mix-organization · [email protected]
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 1%
    epss
  • 10 SEP 13:05Z
    Renovate before 44.14.7 Command Injection via Mix organization
    cvelistv5