Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV L L N H N H H H 8.4 .0069 50.9 —
AFFECTED Product Versions Fixed renovate 37.158.0 – 37.199.0
TIMELINE Aug 16 Reserved by VulnCheck Aug 19 Published (CNA: VulnCheck) Sep 29 RESCORED — CVE-2024-58376 (renovatebot renovate). CVSS 9.3 → 8.4 (NVD).
Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.
| Date | Event | Detail |
|---|---|---|
| August 16, 2026 | Reserved | Reserved by VulnCheck |
| August 19, 2026 | Published | Published (CNA: VulnCheck) |
| September 29, 2026 | RESCORED | RESCORED — CVE-2024-58376 (renovatebot renovate). CVSS 9.3 → 8.4 (NVD). |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| renovatebot | renovate | — | 37.158.0 | 37.199.0 |
Authoritative record: CVE-2024-58376 at cve.org
Vendors: renovatebot
Weaknesses: CWE-78
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-58376 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
