CVE-2026-110867
8.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-863
Impact
Attackers controlling an external preset can execute arbitrary code inside child processes on self-hosted Renovate runners by hijacking critical environment variables. They need the ability to supply or modify a shared Renovate preset used by the target instance.
Root cause
Renovate fails to enforce the environment variable allowlist when restricted variables like PATH or LD_PRELOAD are defined inside a shared preset.
Affected systems
Renovate before 44.60.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade self-hosted Renovate instances to 44.60.1 or later. If upgrading immediately is not possible, disable or restrict untrusted external preset imports.
$ npm install -g renovate@44.60.1AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.