Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Renovate may execute malicious code via protobufjs definitions

published 5 days ago
Summary

Renovate uses the protobufjs library, which turns data format files into JavaScript code. If an attacker can provide a specially crafted definition file, that code could be run on the system running Renovate. Upgrade Renovate to the latest version or apply the vendor's patch to prevent this risk.

What to do
  • Update cleanstart renovate to version 43.181.2-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart renovate < 43.181.2-r1
Fix: upgrade to 43.181.2-r1
Original advisory text
protobufjs compiles protobuf definitions into JavaScript (JS) functions
Security vulnerability affects the renovate package. protobufjs compiles protobuf definitions into JavaScript (JS) functions.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-UC83566 · OSV
Track software like this
Free during beta