Summary
Renovate contains an allowlist bypass that can let repository-controlled configuration indirectly set environment variables intended to remain restricted. On self-hosted instances, an attacker controlling an externally sourced shared preset may influence child processes and potentially alter execution behavior, trust settings, or loaded code.
Renovate contains an allowlist bypass that can let repository-controlled configuration indirectly set environment variables intended to remain restricted. On self-hosted instances, an attacker controlling an externally sourced shared preset may influence child processes and potentially alter execution behavior, trust settings, or loaded code.
Affected context
The issue affects self-hosted Renovate deployments that consume externally sourced shared presets and permit repositories to reference or influence those presets. Risk arises when environment-variable restrictions are enforced at the repository configuration boundary but are not equivalently enforced inside shared preset content.
The issue affects self-hosted Renovate deployments that consume externally sourced shared presets and permit repositories to reference or influence those presets. Risk arises when environment-variable restrictions are enforced at the repository configuration boundary but are not equivalently enforced inside shared preset content.
Exploit preconditions
- Attack surface: Renovate configuration processing and shared preset resolution
- Required access: Ability to control or publish an externally sourced preset, together with a repository that consumes it
- Trigger point: Loading and applying preset configuration before spawning child processes
- Why exploitation is possible: The allowlist boundary can be bypassed when restricted environment-variable settings are embedded in a trusted or shared preset
- Deployment condition: The affected behavior is most consequential on self-hosted instances where child-process environment variables influence local tools and runtime behavior
- Attack surface: Renovate configuration processing and shared preset resolution
- Required access: Ability to control or publish an externally sourced preset, together with a repository that consumes it
- Trigger point: Loading and applying preset configuration before spawning child processes
- Why exploitation is possible: The allowlist boundary can be bypassed when restricted environment-variable settings are embedded in a trusted or shared preset
- Deployment condition: The affected behavior is most consequential on self-hosted instances where child-process environment variables influence local tools and runtime behavior
Why this happens
The underlying flaw is an authorization and policy-enforcement mismatch. Renovate restricts certain environment variables at one configuration layer, but the same restrictions are not consistently applied after values are inherited from shared presets.
This maps to CWE-863: Incorrect Authorization, because configuration data from a less-trusted source can obtain privileges reserved for approved settings. Environment variables such as PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO can affect executable resolution, library loading, runtime initialization, or certificate validation.
The underlying flaw is an authorization and policy-enforcement mismatch. Renovate restricts certain environment variables at one configuration layer, but the same restrictions are not consistently applied after values are inherited from shared presets.
This maps to CWE-863: Incorrect Authorization, because configuration data from a less-trusted source can obtain privileges reserved for approved settings. Environment variables such as PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO can affect executable resolution, library loading, runtime initialization, or certificate validation.
Potential impact
- Child processes may execute unintended binaries or load attacker-controlled libraries
- Runtime behavior may be altered through process initialization settings
- Git operations may trust attacker-selected certificate authorities
- Repository secrets or credentials may be exposed through compromised tooling
- Self-hosted build or automation hosts could be further compromised
- Child processes may execute unintended binaries or load attacker-controlled libraries
- Runtime behavior may be altered through process initialization settings
- Git operations may trust attacker-selected certificate authorities
- Repository secrets or credentials may be exposed through compromised tooling
- Self-hosted build or automation hosts could be further compromised
General mitigation guidance
Mitigation generally focuses on enforcing environment-variable policy at every configuration trust boundary, including inherited and externally sourced presets.
Common defensive patterns include:
- Apply deny rules and allowlists after complete preset resolution, rather than only to direct repository settings
- Use a secure-by-default environment model that exposes only explicitly required variables
- Treat external presets as untrusted input and require provenance or review before use
- Avoid allowing configuration to control process-critical variables such as executable paths, preload settings, runtime options, or certificate authorities
- Run self-hosted workers with least privilege, isolated credentials, and restricted filesystem and network access
- Reduce the number and privilege of child processes that inherit Renovate-managed environment variables
Mitigation generally focuses on enforcing environment-variable policy at every configuration trust boundary, including inherited and externally sourced presets.
Common defensive patterns include:
- Apply deny rules and allowlists after complete preset resolution, rather than only to direct repository settings
- Use a secure-by-default environment model that exposes only explicitly required variables
- Treat external presets as untrusted input and require provenance or review before use
- Avoid allowing configuration to control process-critical variables such as executable paths, preload settings, runtime options, or certificate authorities
- Run self-hosted workers with least privilege, isolated credentials, and restricted filesystem and network access
- Reduce the number and privilege of child processes that inherit Renovate-managed environment variables
How teams detect issues like this
Organizations can detect this class of issue through:
- Static analysis and policy checks for restricted environment-variable names in repository files and shared presets
- Configuration review rules that inspect values after recursive preset expansion
- Alerts when externally sourced presets introduce process, loader, path, runtime, or certificate-related variables
- Code review checks confirming that authorization and allowlist enforcement occurs after configuration merging
- Runtime monitoring for unexpected executable paths, dynamic library loads, Node.js startup options, or certificate-authority changes
- Automated configuration scanners or policy-as-code tools that validate preset provenance and inherited settings
Organizations can detect this class of issue through:
- Static analysis and policy checks for restricted environment-variable names in repository files and shared presets
- Configuration review rules that inspect values after recursive preset expansion
- Alerts when externally sourced presets introduce process, loader, path, runtime, or certificate-related variables
- Code review checks confirming that authorization and allowlist enforcement occurs after configuration merging
- Runtime monitoring for unexpected executable paths, dynamic library loads, Node.js startup options, or certificate-authority changes
- Automated configuration scanners or policy-as-code tools that validate preset provenance and inherited settings
