CVE-2026-76230

Published: Aug 19, 2026Modified: Aug 21, 2026

8.4

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate.

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (5)

https://github.com/renovatebot/renovate/commit/012c0ac2fe32832e60a62bde405c0a241efd314c

Source: disclosure@vulncheck.com

https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c

Source: disclosure@vulncheck.com

https://github.com/renovatebot/renovate/security/advisories/GHSA-fr4j-65pv-gjjj

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/renovate-before-command-injection-via-npm

Source: disclosure@vulncheck.com

https://github.com/renovatebot/renovate/security/advisories/GHSA-fr4j-65pv-gjjj

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.