Description
Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url <value>). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
renovatebot renovate
Default version status: unaffected
32.124.0 to < 42.68.5affected42.68.5unaffected
pkg:npm/renovatemend renovate-ce
Default version status: unaffected
0 to < 13.3.0affected13.3.0unaffected
pkg:npm/renovatemend renovate-ee-server
Default version status: unaffected
0 to < 13.3.0affected13.3.0unaffected
pkg:npm/renovatemend renovate-ee-worker
Default version status: unaffected
0 to < 13.3.0affected13.3.0unaffected
pkg:npm/renovate