[SECURITY]: Announcing 9 High and 1 Moderate security vulnerabilities in Renovate

[jamietanna]

We're announcing 10 GitHub Security Advisories (GHSAs) that affect the Renovate CLI.

There are 9 High and 1 Moderate findings.

It is recommended that you upgrade to a minimum of Renovate 44.14.7 (2026-08-07)

There are no planned backports of these fixes to previous major versions of Renovate.

Bypass for minimumReleaseAge for digest updates

• Moderate (5.8): GHSA-g4qr-hw2h-687r: Digest updates can bypass strict minimumReleaseAge internal checks
  • Fixed in 44.3.1

Potential remote code execution when using binarySource=docker

When running under binarySource=docker, several managers could lead to remote code execution:

• High (7.0): GHSA-mpf8-qxrw-gq3w: manager/gomod: Command injection could be possible via unescaped depName in import-path update command
  • Fixed in 44.14.7
• High (7.8): GHSA-7chm-46wx-888m: manager/gradle-wrapper: Command injection could be possible via unescaped distributionUrl
  • Fixed in 44.14.7
• High (7.8): GHSA-f2v7-35mm-3hx7: manager/maven-wrapper: Command injection could be possible via unescaped distributionType
  • Fixed in 44.14.7
• High (7.0): GHSA-v85g-rq5w-c46q: manager/mix: Command injection could be possible via unescaped organization
  • Fixed in 44.14.7

Potential credential exfiltration when using malicious registry/platform

• High (8.6): GHSA-v73q-hvqx-hxwx: datasource/docker: Malicious Docker servers could send a malicious Link header to allow exfiltrating credentials
  • Fixed in 44.11.2
• High (8.6): GHSA-rh7w-ccch-gh49: datasource/nuget: Malicious Nuget servers could send a malicious Link header to allow exfiltrating credentials
  • Fixed in 44.11.2
• High (8.6): GHSA-w57v-h33h-835c: datasource/github*, platform/github: Malicious GitHub servers could send a malicious Link header to allow exfiltrating credentials
  • Fixed in 44.11.3
• High (8.6): GHSA-9hmg-9h89-jhmx: datasource/gitlab*, platform/gitlab: Malicious GitLab servers could send a malicious Link header to allow exfiltrating credentials
  • Fixed in 44.11.3

Potential exposure in logs for HTTPS certificates

• High (7.7): GHSA-4hmw-qw74-vrhm: TLS private keys were previously not sanitised in logs
  • Fixed in 44.14.4

---

With thanks to everyone involved in responsibly disclosing findings (with or without AI tooling), supporting testing + fixes and rolling out the releases.