CVE-2026-88888

CVE-2026-88888 is a command injection flaw (CWE-78) in the open-source dependency automation tool Renovate, located in its Mix (Elixir) manager when it processes private dependencies. When Renovate running in binarySource=docker mode handles dependency declarations containing unescaped organization parameters, shell metacharacters embedded in package names are passed unescaped to a shell, allowing arbitrary command execution. An attacker who can influence the package names Renovate processes (e.g., via crafted private-dependency metadata in a repository being updated) gains code execution as the Renovate user inside the update job, with high impact on that execution context (CVSS 4.0: 7.3, local vector, high attack complexity with prerequisites). Only deployments running Renovate before 44.14.7 that scan Elixir/Mix projects with private dependencies are affected; other ecosystems and configurations are not implicated by the description. There is no public proof-of-concept, the issue is not in CISA KEV, and no exploitation is known.

What to do: Upgrade Renovate to 44.14.7 or later, prioritizing self-hosted instances configured with binarySource=docker. Check whether any repositories managed by your Renovate instance use Elixir/Mix manifests with private (organization) dependencies; if upgrading is delayed, avoid docker binarySource for Mix scans or restrict/validate dependency and organization names as an interim mitigation. No in-the-wild exploitation is currently known.