Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
mongosh, npm, and Renovate may execute unwanted code
published 1 month ago
Summary
The mongosh, npm, and Renovate tools can be caused to run code that an attacker supplies. This could let an attacker run commands on your system or steal data. Upgrade to the newest versions of each tool to remove the risk.
What to do
- Update cleanstart mongosh to version 2.5.10-r5.
- Update cleanstart mongosh to version 2.6.0-r4.
- Update cleanstart npm to version 11.7.0-r0.
- Update cleanstart renovate to version 43.4.4-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | mongosh |
< 2.5.10-r5 < 2.6.0-r4 Fix: upgrade to 2.5.10-r5
|
| CleanStart | cleanstart | npm |
< 11.7.0-r0 Fix: upgrade to 11.7.0-r0
|
| CleanStart | cleanstart | renovate |
< 43.4.4-r0 Fix: upgrade to 43.4.4-r0
|
Original advisory text
Security fix for CVE-2026-23745 applied in: mongosh 2.5.10-r5, mongosh 2.6.0-r4, npm 11.7.0-r0, renovate 43.4.4-r0
CVE-2026-23745 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
Timeline
Published18 Sep 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-ZI47888 · OSV
Track software like this
Free during beta