Login Request a demo
Medium severity · published Aug 19, 2026
CVE-2026-76232
Renovate 31.51.0 before 40.33.0 Command Injection via helmv3
6.7
CVSS
1%
EPSS
No
On KEV
Description
Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
renovate · renovatebot
31.51.0 before 40.33.0 · source: vendor
Affected product
RE
renovate
renovatebot
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76232
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76232
github.com
https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c
github.com
https://github.com/renovatebot/renovate/commit/f372a68144a4d78c9f7f418168e4efe03336a432
github.com
https://github.com/renovatebot/renovate/security/advisories/GHSA-3f44-xw83-3pmg
www.vulncheck.com
https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv3-2
More from renovate
8.6
CVE-2026-88887
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88882
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88881
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.6
CVE-2026-88880
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.5
CVE-2026-110868
Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources