Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-76230Renovate 35.63.0 before 40.33.0 Command Injection via npm

Medium 6.7

In plain English

A medium-severity command injection in renovate from renovatebot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)1.0%top 36.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	renovate	40.33.0	GHSA-fr4j-65pv-gjjj

Affected products (as reported)

Vendor	Product	Versions
renovatebot	renovate	35.63.0 – before 40.33.0

Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-fr4j-65pv-gjjj) vendor-advisory
Patch Commit patch
Patch Commit patch
VulnCheck Advisory: Renovate 35.63.0 before 40.33.0 Command Injection via npm third-party-advisory