Is CVE-2026-88889 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-88889?

CVE-2026-88889 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-88889

Description

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped distributionType values to achieve remote code execution when Renovate processes Maven Wrapper updates in binarySource=docker mode.