Remote Code Execution in Renovate Bazel Managers

Executive Summary

This is a remote code execution vulnerability in Renovate versions 43.65.0 to 43.102.11. It affects the lockFileMaintenance feature when using bazel-module or bazelisk managers. Attackers can inject malicious dependencies into bazel mod deps calls, such as within ctx.execute statements, to execute arbitrary code.

Useful 0 Not Useful 0

Detection Guidance

Check Renovate version with `renovate --version` or inspect package.json for Renovate dependencies. Look for lockFileMaintenance enabled in Renovate config files (e.g., renovate.json). Examine Bazel module files for suspicious ctx.execute calls referencing external dependencies.

Useful 0 Not Useful 0

Impact Analysis

If exploited, attackers could run arbitrary code on your system. This requires high privileges but has low attack complexity. Self-hosted users must explicitly allow unsafe executions via an allowlist. Upgrading to version 43.102.11 or later mitigates the risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts software supply chain integrity rather than direct data exposure. While not a direct violation of GDPR or HIPAA, it could indirectly affect compliance by enabling unauthorized code execution in development environments. Organizations using Renovate in regulated environments must ensure proper access controls and patch management to prevent potential violations of integrity requirements in standards like GDPR Article 32 or HIPAA Security Rule §164.308.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Renovate to version 43.102.11 or later. Disable lockFileMaintenance for bazel-module and bazelisk managers in Renovate configuration. If self-hosted, ensure allowedUnsafeExecutions is not enabled for these managers.

Useful 0 Not Useful 0