CVE-2026-76230: Renovate 35.63.0 before 40.33.0 Command Injection via npm
Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
renovateto a version that resolves this vulnerability.Fixed in 40.33.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs write access to a repository processed by Renovate. They can place a malicious Renovate configuration containing a crafted npm packageName value.
What systems are at risk?
The affected component is the npm manager in Renovate versions 35.63.0 through versions before 40.33.0. Successful exploitation executes arbitrary commands on the machine where Renovate runs.
Is user interaction required for exploitation?
No. The supplied vector indicates no user interaction is required, but exploitation requires high privileges in the form of repository write access.