Medium severity · published Aug 19, 2026
CVE-2026-76233
Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager
6.7
CVSS
1%
EPSS
No
On KEV
Description
Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
renovate · renovatebot
39.53.0 before 40.33.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76233
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76233
github.com
https://github.com/renovatebot/renovate/commit/d29698e0131231652970f02765312769975e4d38
github.com
https://github.com/renovatebot/renovate/security/advisories/GHSA-xjr7-3c3g-m763
www.vulncheck.com
https://www.vulncheck.com/advisories/renovate-before-command-injection-via-gleam-manager
More from renovate
8.6
CVE-2026-88887
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88882
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88881
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.6
CVE-2026-88880
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.5
CVE-2026-110868
Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources