Renovate CVE-2026-76227

Exploitation requires three conditions: (1) a Renovate instance running a vulnerable version (npm package >= 42.68.1 and < 42.96.3, or >= 43.0.0 and < 43.4.4); (2) the ability to influence code that Renovate executes as a child process - via write access to a repository's Renovate configuration (postUpgradeTasks, postUpdateOptions) for an insider attack, or via a compromised npm dependency with a postinstall hook for an outsider/supply-chain attack; and (3) the presence of valuable secrets in the Renovate process environment (e.g., GitHub PATs, registry tokens, cloud credentials). Exploitation is limited by the local attack vector - the attacker cannot directly reach the environment variables remotely; they must cause Renovate to execute their code during a scheduled or triggered run. The CVSS PR:L reflects that repository write access (or equivalent) is sufficient. Default Renovate deployments that do not use postUpgradeTasks still expose secrets through npm install postinstall hooks of processed packages.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H) scores 6.8, reflecting local attack vector with low-privilege access and high confidentiality impact. The local vector (AV:L) is accurate: exploitation requires the ability to influence code that Renovate executes - either through repository-level configuration (postUpgradeTasks) or via a compromised npm dependency. This is not remote unauthenticated exploitation, but the attack surface is meaningfully wide in practice because Renovate routinely processes external package ecosystems. The high confidentiality impact (VC:H) correctly captures the credential exfiltration risk: secrets accessible to Renovate deployments (GitHub PATs with broad repository access, npm publish tokens, cloud provider credentials) are high-value targets. EPSS data is not available in the provided intelligence. No KEV listing exists - active exploitation is not confirmed. However, the vendor's recommendation to proactively rotate all credentials implies a credible exploitation risk over the roughly three-month exposure window (2025-12-30 to patch release). Despite the moderate overall score, operational risk is elevated for organizations where Renovate runs with broad privileged credentials against repositories that execute external or attacker-influenceable code.

An outside attacker who has compromised an npm package processed by Renovate - or who can submit a malicious postinstall script via a dependency - could embed credential-harvesting code that reads environment variables (e.g., process.env) and exfiltrates them to an external server during npm install execution. Alternatively, an insider with repository write access could add a malicious postUpgradeTasks script to the Renovate configuration, which executes with full access to the Renovate process environment including tokens and cloud credentials. No public proof-of-concept code has been identified, but the exploitation technique requires only standard Node.js environment variable access.