Medium severity · published Aug 19, 2026
CVE-2026-76226
Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
renovate · renovatebot
43.65.0 before 43.102.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76226
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76226
vendor-advisory
https://github.com/renovatebot/renovate/security/advisories/GHSA-5vjq-5jmg-39xq
third-party-advisory
https://www.vulncheck.com/advisories/renovate-through-remote-code-execution-via-lockfilemaintenance
More from renovate
8.6
CVE-2026-88887
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88882
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88881
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.6
CVE-2026-88880
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.5
CVE-2026-110868
Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources