{"id":"CVE-2024-58376","revision":"ac730d32ae734cd6958b5db8c6ff7dfa","records":[{"revision":"ac730d32ae734cd6958b5db8c6ff7dfa","observedAt":"2026-10-25T01:17:17.137+00:00","statement":{"source":"nvd","id":"CVE-2024-58376","aliases":[],"title":"Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryA…","description":"Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.","state":0,"publishedAt":"2026-08-19T14:17:16.24+00:00","modifiedAt":"2026-10-01T23:10:00.233+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.4,"severity":"HIGH"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Primary","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":6.7,"severity":"MEDIUM"}],"references":["https://github.com/renovatebot/renovate/security/advisories/GHSA-rqgv-292v-5qgr","https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-58376","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-78"],"productCriteria":[],"sourceDates":{"published":"2026-08-19T14:17:16.240","lastModified":"2026-10-01T23:10:00.233"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2024-58376","identifiers":["CVE-2024-58376"]},"retained":false,"historicalAffected":[]}],"coverage":[]}