Medium severity · published Aug 19, 2026
CVE-2024-58376
Renovate 37.158.0 before 37.199.0 Command Injection via helmv3
6.7
CVSS
0.7%
EPSS
No
On KEV
Description
Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
renovate · renovatebot
37.158.0 before 37.199.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-58376
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-58376
vendor-advisory
https://github.com/renovatebot/renovate/security/advisories/GHSA-rqgv-292v-5qgr
third-party-advisory
https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3
More from renovate
8.6
CVE-2026-88887
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88882
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88881
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.6
CVE-2026-88880
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.5
CVE-2026-110868
Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources