Medium severity · published Aug 19, 2026
CVE-2026-76229
Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize
6.7
CVSS
1%
EPSS
No
On KEV
Description
Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yaml files with specially crafted chart names to execute arbitrary commands on the Renovate host machine.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
renovate · renovatebot
39.218.0 before 40.33.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76229
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76229
github.com
https://github.com/renovatebot/renovate/commit/cc08c6e98f19e6258c5d3180c70c98e1be0b0d37
github.com
https://github.com/renovatebot/renovate/security/advisories/GHSA-xv56-3wq5-9997
www.vulncheck.com
https://www.vulncheck.com/advisories/renovate-before-arbitrary-command-injection-via-kustomize
More from renovate
8.6
CVE-2026-88887
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88882
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88881
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.6
CVE-2026-88880
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.5
CVE-2026-110868
Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources