CVE-2024-58376

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-58376", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-16T13:02:14.690Z", "datePublished": "2026-08-19T14:01:49.687Z", "dateUpdated": "2026-09-29T22:10:34.429Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-29T22:10:34.429Z"}, "datePublic": "2024-04-23T00:00:00.000Z", "title": "Renovate 37.158.0 before 37.199.0 Command Injection via helmv3", "descriptions": [{"lang": "en", "value": "Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "cweId": "CWE-78", "type": "CWE"}]}], "affected": [{"vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "packageURL": "pkg:npm/renovate", "versions": [{"version": "37.158.0", "status": "affected", "versionType": "semver", "lessThan": "37.199.0"}, {"version": "37.199.0", "status": "unaffected", "versionType": "semver"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.4, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-rqgv-292v-5qgr", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-rqgv-292v-5qgr)"}, {"name": "VulnCheck Advisory: Renovate 37.158.0 before 37.199.0 Command Injection via helmv3", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3"}], "credits": [{"lang": "en", "value": "meyfa", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T13:52:34.194922Z", "id": "CVE-2024-58376", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T15:23:34.198Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-58376", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-20T13:52:34.194922Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T13:52:42.337Z"}}], "cna": {"title": "Renovate 37.158.0 before 37.199.0 Command Injection via helmv3", "credits": [{"lang": "en", "type": "reporter", "value": "meyfa"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "37.158.0", "lessThan": "37.199.0", "versionType": "semver"}, {"status": "unaffected", "version": "37.199.0", "versionType": "semver"}], "packageURL": "pkg:npm/renovate", "defaultStatus": "unaffected"}], "datePublic": "2024-04-23T00:00:00.000Z", "references": [{"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-rqgv-292v-5qgr", "name": "GitHub Security Advisory (GHSA-rqgv-292v-5qgr)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3", "name": "VulnCheck Advisory: Renovate 37.158.0 before 37.199.0 Command Injection via helmv3", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-29T22:10:34.429Z"}}}, "cveMetadata": {"cveId": "CVE-2024-58376", "state": "PUBLISHED", "dateUpdated": "2026-09-29T22:10:34.429Z", "dateReserved": "2026-08-16T13:02:14.690Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-19T14:01:49.687Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/renovate", "product": "renovate", "vendor": "renovatebot", "versions": [{"lessThan": "37.199.0", "status": "affected", "version": "37.158.0", "versionType": "semver"}, {"status": "unaffected", "version": "37.199.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment."}, {"lang": "es", "value": "Las versiones de Renovate 37.158.0 anteriores a la 37.199.0 contienen una vulnerabilidad de inyecci\u00f3n de comandos en el manejo de registryAliases del gestor helmv3 que permite a los atacantes con acceso de confirmaci\u00f3n ejecutar comandos arbitrarios. Los atacantes pueden manipular las claves de registryAliases con metacaracteres de shell sin comillas para inyectar comandos ejecutados durante las operaciones de 'helm repo add', obteniendo acceso total al entorno de ejecuci\u00f3n de Renovate."}], "id": "CVE-2024-58376", "lastModified": "2026-10-01T23:10:00.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58376", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T13:52:34.194922Z", "version": "2.0.3"}}]}, "published": "2026-08-19T14:17:16.240", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-rqgv-292v-5qgr"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "renovate: Renovate 37.158.0 before 37.199.0 Command Injection via helmv3", "id": "2519593", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519593"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.", "A flaw was found in Renovate's helmv3 manager. This command injection vulnerability allows an attacker with commit access to a repository to execute arbitrary commands. By manipulating registryAliases keys with unquoted shell metacharacters, an attacker can inject commands during helm repo add operations, leading to full control over the Renovate execution environment. This poses a significant risk, particularly in continuous integration/continuous delivery (CI/CD) or development workflows."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2024-58376", "public_date": "2026-08-19T14:01:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-58376\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-58376\nhttps://github.com/renovatebot/renovate/security/advisories/GHSA-rqgv-292v-5qgr\nhttps://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3"], "statement": "This Important flaw in Renovate's helmv3 manager allows for arbitrary command execution due to a command injection vulnerability. While exploitation requires an attacker to have commit access to the repository, successful exploitation grants full control over the Renovate execution environment, posing a significant risk in CI/CD or development workflows.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[37.158.0,37.199.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "37.199.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "renovate", "source": "cna", "vendor": "renovatebot"}, "product": "renovate", "vendor": "renovatebot"}], "created": "2026-08-19T18:45:03.680250+00:00", "updated": "2026-10-01T22:00:17.803779+00:00", "vendors": ["renovatebot", "renovatebot$PRODUCT$renovate"]}