GHSA-rqgv-292v-5qgr: 
JavaScript vulnerability analysis and mitigation

A moderate severity vulnerability (GHSA-rqgv-292v-5qgr) was discovered in Renovate affecting versions 37.158.0 to 37.199.0. The vulnerability allows attackers with commit access to the default branch of a repository using Renovate to execute arbitrary commands through manipulation of helmv3 registryAliases. The issue was patched in version 37.199.0 (GitHub Advisory).

The vulnerability stems from the helmv3 manager's handling of registryAliases after they became mergeable in PR #26848. The issue lies in the unquoted key used in the helm repo add command, which allows attackers to inject variable references ($FOO) and shell commands. The vulnerability has a CVSS v3.1 score of 5.4, with attack vector being Network, attack complexity Low, and privileges required Low (GitHub Advisory).

The vulnerability provides attackers with full access to Renovate's execution environment. The severity impact varies depending on the deployment method (Docker, Kubernetes, CI pipeline) and whether Renovate is exposed to untrusted users or repositories. The vulnerability affects confidentiality and integrity with low impact, while availability remains unaffected (GitHub Advisory).

The vulnerability can be exploited by adding a malicious Helm chart with an outdated dependency and manipulating the renovate.json configuration file to include crafted registryAliases. When Renovate processes the repository, it executes the injected commands and exposes their output through pull request comments (GitHub Advisory).

The vulnerability has been patched in Renovate version 37.199.0 by implementing proper quoting of command parameters. Users should upgrade to this version or later to mitigate the risk. The fix involves using the shlex.quote function to properly escape command parameters (Renovate Fix).