Medium severity · published Aug 19, 2026
CVE-2026-76231
Renovate 32.135.0 before 40.33.0 Command Injection via hermit
6.7
CVSS
1%
EPSS
No
On KEV
Description
Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
renovate · renovatebot
32.135.0 before 40.33.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76231
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76231
github.com
https://github.com/renovatebot/renovate/commit/41e8b99f86a6e2a56f80f7aa1a08a59d76f2358c
github.com
https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c
github.com
https://github.com/renovatebot/renovate/commit/b696abb3c2741508fbb4029f39153140a3722e1e
github.com
https://github.com/renovatebot/renovate/commit/eaec10d7c8afadbdd783ac47bd2adbfab444d6df
github.com
https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff
www.vulncheck.com
https://www.vulncheck.com/advisories/renovate-before-command-injection-via-hermit
More from renovate
8.6
CVE-2026-88887
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88882
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88881
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.6
CVE-2026-88880
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.5
CVE-2026-110868
Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources