Vulnerability Description
Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/renovatebot/renovate/commit/012c0ac2fe32832e60a62bde405c0a241
- https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff
- https://github.com/renovatebot/renovate/security/advisories/GHSA-fr4j-65pv-gjjj
- https://www.vulncheck.com/advisories/renovate-before-command-injection-via-npm
- https://github.com/renovatebot/renovate/security/advisories/GHSA-fr4j-65pv-gjjj
FAQ
What is CVE-2026-76230?
CVE-2026-76230 is a vulnerability with a CVSS score of 6.7 (MEDIUM). Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sa...
How severe is CVE-2026-76230?
CVE-2026-76230 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-76230?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.