Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-76232Renovate 31.51.0 before 40.33.0 Command Injection via helmv3

Medium 6.7

In plain English

A medium-severity command injection in renovate from renovatebot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)1.0%top 36.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	renovate	40.33.0	GHSA-3f44-xw83-3pmg

Affected products (as reported)

Vendor	Product	Versions
renovatebot	renovate	31.51.0 – before 40.33.0

Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-3f44-xw83-3pmg) vendor-advisory
Patch Commit patch
Patch Commit patch
VulnCheck Advisory: Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 third-party-advisory