CVE-2026-88885

CVE-2026-88885 is an OS command injection flaw (CWE-78) in the gomod manager of Renovate, the automated dependency-update tool, affecting all versions before 44.14.7. It is triggered when Renovate performs a Go module major-version update with the postUpdateOptions gomodUpdateImportPaths option enabled and binarySource=docker, because depName parameters used in import-path update commands are not escaped. An attacker who can influence a dependency's import path (depName) injects shell metacharacters and executes arbitrary commands as the Renovate user. Successful exploitation yields command execution in the repository automation environment, which typically holds write tokens, CI credentials, and secrets. No public proof-of-concept is known, it is not in CISA KEV, and there are no reports of in-the-wild exploitation.

What to do: Upgrade Renovate to 44.14.7 or later. Until upgraded, mitigate by not using binarySource=docker for the gomod manager or by removing gomodUpdateImportPaths from postUpdateOptions on Go module updates, and review Renovate logs for unexpected command execution, rotating repository tokens if compromise is suspected.