Renovate CVE-2026-76226

Exploitation requires all of the following conditions to be simultaneously present: Renovate version 43.65.0 through 43.102.10 running in self-hosted (open-source) mode; the bazel-module or bazelisk manager configured for one or more repositories; lockFileMaintenance enabled for those managers; bazel-module or bazelisk explicitly listed in the allowedUnsafeExecutions self-hosted configuration key (this is not the default and requires deliberate administrator action); a Bazel module extension in the target repository that calls ctx.execute in a way that references an external dependency; and a malicious version of that dependency reachable from the configured registry. Mend Renovate Self-Hosted (commercial) is explicitly not affected per vendor advisory. The allowedUnsafeExecutions opt-in is the primary limiting factor - no exploitation is possible in default Renovate deployments.

The vendor-assigned CVSS 4.0 score of 6.8 uses AV:L/AC:L/AT:N/PR:H, reflecting a local attack context requiring high-privilege configuration - an administrator must explicitly add bazel-module or bazelisk to the allowedUnsafeExecutions allowlist, a non-default opt-in that the vendor explicitly marks as unsafe. This dramatically narrows the real-world attack surface: the feature is disabled by default and must be actively enabled. No KEV listing exists, no EPSS data was provided in the intelligence set, and no public exploit code has been identified. The integrity and availability impacts are severe (VI:H/VA:H) if conditions are met, since arbitrary code runs on the Renovate host with whatever permissions the process holds - but the prerequisite non-default configuration stack makes mass exploitation implausible. The window was open from 2026-03-12 to 2026-04-02 (roughly three weeks); affected operators should audit Renovate logs for bazel mod deps activity during that period. Overall: genuinely serious for the narrow population of self-hosted Renovate operators who opted into allowedUnsafeExecutions with Bazel managers, but low priority for everyone else.

An attacker who controls or compromises a Bazel dependency package publishes a malicious version containing arbitrary host commands within a module extension's ctx.execute call. When an affected self-hosted Renovate instance runs its scheduled lockFileMaintenance job against a repository that references this dependency in a bazel mod deps context, the malicious ctx.execute code runs on the Renovate host with the process's full OS-level permissions. No public proof-of-concept code has been identified, but the attack requires no interaction beyond the automated Renovate scheduling cycle once the non-default configuration prerequisites are in place.