Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
cleanstart/renovate may mishandle input causing unexpected command execution
published 16 days ago
Summary
The cleanstart/renovate package versions before 1 can incorrectly process quoted strings, which could let an attacker influence how commands are run. This could lead to unauthorized actions on your system. Update to version 1 or later, or apply the vendor’s recommended patch, to prevent the issue.
What to do
- Update cleanstart renovate to version 43.177.9-r1.
- Update cleanstart renovate to version 43.180.0-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | renovate |
< 43.177.9-r1 < 43.180.0-r1 Fix: upgrade to 43.177.9-r1
|
Original advisory text
shell-quote prior to 1
CVE-2026-13311 affects multiple packages. shell-quote prior to 1. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published20 Oct 2026
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLEANSTART-2026-AC35633 · OSV
Track software like this
Free during beta