Vulnerability Description
Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/renovatebot/renovate/commit/41e8b99f86a6e2a56f80f7aa1a08a59d7
- https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff
- https://github.com/renovatebot/renovate/commit/b696abb3c2741508fbb4029f39153140a
- https://github.com/renovatebot/renovate/commit/eaec10d7c8afadbdd783ac47bd2adbfab
- https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff
- https://www.vulncheck.com/advisories/renovate-before-command-injection-via-hermi
- https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff
FAQ
What is CVE-2026-76231?
CVE-2026-76231 is a vulnerability with a CVSS score of 6.7 (MEDIUM). Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands witho...
How severe is CVE-2026-76231?
CVE-2026-76231 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-76231?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.