Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
Renovate could run unwanted code through jsonata-js
published 5 days ago
Summary
The Renovate tool includes the jsonata-js library (versions up to 2), which contains a flaw that could let an attacker cause the tool to execute arbitrary code. This could affect automated dependency updates and potentially compromise your systems. Update Renovate to a version that includes a fixed jsonata-js or apply the vendor’s recommended patch as soon as possible.
What to do
- Update cleanstart renovate to version 43.181.2-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | renovate |
< 43.181.2-r1 Fix: upgrade to 43.181.2-r1
|
Original advisory text
weakness has been identified in jsonata-js jsonata up to 2
Security vulnerability affects the renovate package. A weakness has been identified in jsonata-js jsonata up to 2.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-WT63862 · OSV
Track software like this
Free during beta