GHSA-3f44-xw83-3pmg: Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml file

January 13, 2026

The user-provided string repository in the helmv3 manager is appended to the helm registry login command without proper sanitization.

References

github.com/advisories/GHSA-3f44-xw83-3pmg
github.com/renovatebot/renovate
github.com/renovatebot/renovate/security/advisories/GHSA-3f44-xw83-3pmg

Code Behaviors & Features

Detect and mitigate GHSA-3f44-xw83-3pmg with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →