Vulnerability · Published Sep 10, 2026 · Assigned by VulnCheck

CVE-2026-88889Renovate before 44.14.7 Command Injection via distributionType

High 7.8

In plain English

A high-severity OS command injection in mend-renovate-ce from mend. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)1.0%top 35.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped distributionType values to achieve remote code execution when Renovate processes Maven Wrapper updates in binarySource=docker mode.

Affected products (as reported)

Vendor	Product	Versions
renovatebot	renovate	0 – before 44.14.7
mend	renovate-ce	0 – before 15.4.0
mend	renovate-ee-server	0 – before 15.4.0
mend	renovate-ee-worker	0 – before 15.4.0
mend	mend-renovate-ce	0 – before 15.4.0
mend	mend-renovate-enterprise-edition	0 – before 10.4.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-f2v7-35mm-3hx7) vendor-advisory
VulnCheck Advisory: Renovate before 44.14.7 Command Injection via distributionType third-party-advisory