Vulnerability Description
Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff
- https://github.com/renovatebot/renovate/commit/f372a68144a4d78c9f7f418168e4efe03
- https://github.com/renovatebot/renovate/security/advisories/GHSA-3f44-xw83-3pmg
- https://www.vulncheck.com/advisories/renovate-before-command-injection-via-helmv
- https://github.com/renovatebot/renovate/security/advisories/GHSA-3f44-xw83-3pmg
FAQ
What is CVE-2026-76232?
CVE-2026-76232 is a vulnerability with a CVSS score of 6.7 (MEDIUM). Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper ...
How severe is CVE-2026-76232?
CVE-2026-76232 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-76232?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.