Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-76229Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

Medium 6.7

In plain English

A medium-severity command injection in renovate from renovatebot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)1.0%top 36.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yaml files with specially crafted chart names to execute arbitrary commands on the Renovate host machine.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	renovate	40.33.0	GHSA-xv56-3wq5-9997

Affected products (as reported)

Vendor	Product	Versions
renovatebot	renovate	39.218.0 – before 40.33.0

Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-xv56-3wq5-9997) vendor-advisory
Patch Commit patch
VulnCheck Advisory: Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize third-party-advisory