Medium severity · published Aug 19, 2026
CVE-2026-76230
Renovate 35.63.0 before 40.33.0 Command Injection via npm
6.7
CVSS
1%
EPSS
No
On KEV
Description
Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
renovate · renovatebot
35.63.0 before 40.33.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76230
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76230
github.com
https://github.com/renovatebot/renovate/commit/012c0ac2fe32832e60a62bde405c0a241efd314c
github.com
https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c
github.com
https://github.com/renovatebot/renovate/security/advisories/GHSA-fr4j-65pv-gjjj
www.vulncheck.com
https://www.vulncheck.com/advisories/renovate-before-command-injection-via-npm
More from renovate
8.6
CVE-2026-88887
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88882
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88881
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.6
CVE-2026-88880
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.5
CVE-2026-110868
Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources