CVE-2026-76229: Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize
Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yaml files with specially crafted chart names to execute arbitrary commands on the Renovate host machine.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Renovateto a version that resolves this vulnerability.Fixed in 40.33.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs write access to a repository processed by Renovate and must be able to add or modify a kustomization.yaml file with a specially crafted chart name.
What systems are exposed?
Renovate hosts running versions from 39.218.0 up to, but not including, 40.33.0 are affected when the kustomize manager processes attacker-controlled kustomization.yaml content.
What is the impact of successful exploitation?
A malicious chart name can be appended to a helm pull command without proper sanitization, allowing arbitrary commands to run on the Renovate host machine. The reported impact includes high confidentiality, integrity, and availability effects.