Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-76231Renovate 32.135.0 before 40.33.0 Command Injection via hermit

Medium 6.7

In plain English

A medium-severity command injection in renovate from renovatebot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)1.0%top 36.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	renovate	40.33.0	GHSA-36j9-mx87-2cff

Affected products (as reported)

Vendor	Product	Versions
renovatebot	renovate	32.135.0 – before 40.33.0

Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-36j9-mx87-2cff) vendor-advisory
Patch Commit patch
Patch Commit patch
Patch Commit patch
Patch Commit patch
VulnCheck Advisory: Renovate 32.135.0 before 40.33.0 Command Injection via hermit third-party-advisory