CVE-2024-58376
1 advisory.
npm/renovate CVE-2024-58376: medium 5.4
Renovate vulnerable to arbitrary command injection via helmv3 manager and registryAliases
Action: Upgrade renovate to 37.199.0 or later.
npm i renovate@37.199.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 37.158.0 | 37.199.0 | - |
Fixed versions
| 37.199.0 |
Sources
- osv: GHSA-rqgv-292v-5qgr
- https://github.com/renovatebot/renovate/security/advisories/GHSA-rqgv-292v-5qgr
- https://github.com/renovatebot/renovate/commit/1e941fd885c799f2d38f4084a6f4cb9438813c8f
- https://github.com/renovatebot/renovate
- https://github.com/renovatebot/renovate/blob/23f3df6216375cb5bcfe027b0faee304f877f891/lib/modules/manager/helmv3/artifacts.ts#L80
CVE-2024-58376 · published · modified · JSON