CVE-2026-88885
No fix known EPSS <1%CVSS 7.0
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary commands as the Renovate user during Go module major version updates with postUpdateOptions gomodUpdateImportPaths enabled.
Products: renovatebot renovate, mend renovate-ce, mend renovate-ee-server, mend renovate-ee-worker, mend-renovate-ce, mend-renovate-enterprise-edition