CVE-2026-88889

Renovate, the open-source automated dependency update tool maintained by Mend, before version 44.14.7 contains an OS command injection flaw (CWE-78) in its Maven Wrapper manager. An attacker who can control the distributionType parameter in a repository's maven-wrapper.properties file — such as a contributor or anyone with write access to a repository managed by Renovate — can inject unescaped shell commands. When Renovate processes Maven Wrapper updates while running in binarySource=docker mode, the injected commands execute, giving the attacker arbitrary code execution inside the Renovate container and access to any credentials, tokens, or repositories it can reach. Users running affected Renovate versions in docker mode against repositories containing maven-wrapper.properties are exposed. No exploitation has been reported: the flaw is not in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade Renovate to version 44.14.7 or later. Until then, avoid running Renovate in binarySource=docker mode when it may process Maven Wrapper updates, review changes to maven-wrapper.properties in managed repositories (especially the distributionType field), and limit the tokens and secrets available to the Renovate container. Check whether your deployment uses docker mode and whether any managed repositories include maven-wrapper.properties to gauge exposure.