CVE-2026-76226: Renovate 43.65.0 through 43.102.11 Remote Code Execution via lockFileMaintenance
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bazel-mods/bazelisk (lockFileMaintenance affected range)to a version that resolves this vulnerability.Fixed in 43.102.11
Event History
Frequently Asked Questions
Which Renovate configurations are exposed to this issue?
The vulnerable path involves the bazel-module and bazelisk managers when lockFileMaintenance is in use. Renovate versions from 43.65.0 up to, but not including, 43.102.11 are affected.
What does an attacker need to exploit it?
An attacker needs to provide a malicious dependency that Renovate references during bazel mod deps processing. The malicious dependency can cause arbitrary code execution through constructs such as ctx.execute statements.
Is this exploitable remotely without any access to the Renovate environment?
The provided vector is AV:L with PR:H, indicating exploitation requires local access and high privileges. The available data does not establish unauthenticated remote exploitation.