Security Advisory catalog CVE-2026-88889 Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory .
cve-program · CVE-2026-88889 Published
Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped distributionType values to achieve remote code execution when Renovate processes Maven Wrapper updates in binarySource=docker mode.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-88889 Published renovate Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "renovatebot",
"product": "renovate",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "44.14.7"
},
{
"version": "44.14.7",
"status": "unaffected",
"versionType": "semver"
}
]
} renovate-ce Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "mend",
"product": "renovate-ce",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "15.4.0"
},
{
"version": "15.4.0",
"status": "unaffected",
"versionType": "semver"
}
]
} renovate-ee-server Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "mend",
"product": "renovate-ee-server",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "15.4.0"
},
{
"version": "15.4.0",
"status": "unaffected",
"versionType": "semver"
}
]
} renovate-ee-worker Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "mend",
"product": "renovate-ee-worker",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "15.4.0"
},
{
"version": "15.4.0",
"status": "unaffected",
"versionType": "semver"
}
]
} mend-renovate-ce Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "mend",
"product": "mend-renovate-ce",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "15.4.0"
},
{
"version": "15.4.0",
"status": "unaffected",
"versionType": "semver"
}
]
} mend-renovate-enterprise-edition Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "mend",
"product": "mend-renovate-enterprise-edition",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "10.4.0"
},
{
"version": "10.4.0",
"status": "unaffected",
"versionType": "semver"
}
]
} Original source record · Cite this exact observation · Complete original publisher JSON