Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
Renovate: Bazel Manager Allows Remote Code Execution with Malicious Dependency
GHSA-5vjq-5jmg-39xq
Summary
Renovate's Bazel manager allowed a malicious dependency to execute code on your system if you used a specific feature. This has been fixed, but you should review your settings to ensure you're not vulnerable. Update your allowed executions list if necessary and review your dependencies for potential security risks.
What to do
- Update GitHub Actions renovate to version 43.102.11.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | renovate |
>= 43.65.0, < 43.102.11 Fix: upgrade to 43.102.11
|
Original title
Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance
Original description
When using [`lockFileMaintenance`](https://docs.renovatebot.com/configuration-options/#lockfilemaintenance) using the [bazel-module](https://docs.renovatebot.com/modules/manager/bazel-module/) or [bazelisk](https://docs.renovatebot.com/modules/manager/bazelisk/) managers between Renovate [43.65.0](https://github.com/renovatebot/renovate/releases/tag/43.65.0) (2026-03-12) and [43.102.11](https://github.com/renovatebot/renovate/releases/tag/43.102.11) (2026-04-02), there was the opportunity for remote code execution from a malicious dependency, _if the Bazel module executes code that relies on a dependency_.
As this is an "unsafe" execution path, we have disabled this by default, and self-hosted administrators must add it to the [`allowedUnsafeExecutions`](https://docs.renovatebot.com/self-hosted-configuration/#allowedunsafeexecutions) allowlist.
It is recommended to review whether you have enabled this functionality for these managers, and if so, whether any dependency updates may have led to remote code execution.
## Impact
If Renovate suggested an update to a malicious dependency, _and_ that dependency is referenced as part of the `bazel mod deps` call - for instance as part of a `ctx.execute` call - this would call attacker-controlled code.
This could lead to [insider attackers](https://docs.renovatebot.com/security-and-permissions/#execution-of-code-insider-attack) and [outside attackers](https://docs.renovatebot.com/security-and-permissions/#execution-of-code-outsider-attack), executing code that is distributed as part of the package.
## Patches
This is patched in [43.102.11](https://github.com/renovatebot/renovate/releases/tag/43.102.11).
This does not affect any versions of [Mend Renovate Self-Hosted](https://www.mend.io/renovate/).
## Workarounds
- Upgrade your Renovate version
- Disable `lockFileMaintenance` for these managers
## Why did this happen?
This was missed in code review (as part of https://github.com/renovatebot/renovate/pull/41507).
As this is an "unsafe" execution path, we have disabled this by default, and self-hosted administrators must add it to the [`allowedUnsafeExecutions`](https://docs.renovatebot.com/self-hosted-configuration/#allowedunsafeexecutions) allowlist.
It is recommended to review whether you have enabled this functionality for these managers, and if so, whether any dependency updates may have led to remote code execution.
## Impact
If Renovate suggested an update to a malicious dependency, _and_ that dependency is referenced as part of the `bazel mod deps` call - for instance as part of a `ctx.execute` call - this would call attacker-controlled code.
This could lead to [insider attackers](https://docs.renovatebot.com/security-and-permissions/#execution-of-code-insider-attack) and [outside attackers](https://docs.renovatebot.com/security-and-permissions/#execution-of-code-outsider-attack), executing code that is distributed as part of the package.
## Patches
This is patched in [43.102.11](https://github.com/renovatebot/renovate/releases/tag/43.102.11).
This does not affect any versions of [Mend Renovate Self-Hosted](https://www.mend.io/renovate/).
## Workarounds
- Upgrade your Renovate version
- Disable `lockFileMaintenance` for these managers
## Why did this happen?
This was missed in code review (as part of https://github.com/renovatebot/renovate/pull/41507).
ghsa CVSS3.1
6.3
Vulnerability type
CWE-94
Code Injection
Published: 16 Apr 2026 · Updated: 16 Apr 2026 · First seen: 16 Apr 2026