Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-76233Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager

Medium 6.7

In plain English

A medium-severity command injection in renovate from renovatebot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)1.0%top 36.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	renovate	40.33.0	GHSA-xjr7-3c3g-m763

Affected products (as reported)

Vendor	Product	Versions
renovatebot	renovate	39.53.0 – before 40.33.0

Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-xjr7-3c3g-m763) vendor-advisory
Patch Commit patch
VulnCheck Advisory: Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager third-party-advisory