CVE-2026-88888
Last modified
CVE-2026-88888 is a high-severity vulnerability rated 7/10 on the CVSS scale. Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in binarySource=docker mode..
Description
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in binarySource=docker mode.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| renovatebot | renovate | < 44.14.7 |
| renovatebot | renovate | < 15.4.0 |
| renovatebot | renovate | < 10.4.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-88888?
How severe is CVE-2026-88888?
How do I fix CVE-2026-88888?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-88882Renovate is a dependency update automation tool. In versions…8.6
- CVE-2026-88883Renovate is an automated dependency update tool. In versions…7.7
- CVE-2026-88884Renovate is a dependency update automation tool. In versions…5.8
- CVE-2026-88885Renovate before 44.14.7 contains a command injection vulnera…7
- CVE-2026-88886Renovate is a dependency update automation tool. In versions…7.8
- CVE-2026-88887Renovate is a dependency update automation tool. When listin…8.6
- CVE-2026-88889Renovate before 44.14.7 contains a command injection vulnera…7.8
- CVE-2026-8889Version 3.0.7 of the Securly Chrome Extension uses deprecate…7.5
- CVE-2026-88890OpenPanel through commit cd24bb8 contains an SQL injection v…8.5
- CVE-2026-88891OpenPanel fails to enforce read-only project access level on…8.3
- CVE-2026-88892OpenPanel is an analytics platform. In all versions (no patc…5
- CVE-2026-88893OpenPanel share lookup procedures fail to validate access co…7.5
Are you affected by CVE-2026-88888?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST