Bug 2531420 (CVE-2026-88888) - CVE-2026-88888 renovate: Renovate: Command Injection via Mix organization
Summary: CVE-2026-88888 renovate: Renovate: Command Injection via Mix organization
Keywords:
Status: NEW
Alias: CVE-2026-88888
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-10 13:21 UTC by OSIDB Bzimport
Modified: 2026-09-10 13:27 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-10 13:21:37 UTC 
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in binarySource=docker mode.
Note You need to log in before you can comment on or make changes to this bug.