CVE-2026-76231: Renovate 32.135.0 before 40.33.0 Command Injection via hermit

Q: What version should be deployed to remediate this issue?

Upgrade Renovate to version 40.33.0 or later. Versions from 32.135.0 up to, but not including, 40.33.0 are affected.

Published Aug 19, 2026

Updated

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate.

Affected Software

1 affected component

Renovate>32.135.0<=40.33.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Renovate hermit manager to a version that resolves this vulnerability.
Fixed in 40.33.0Patch Command Injection via hermit

Event History

Aug 19, 2026

CVE Published

via MITRE·02:02 PM

Data Sourced

via MITRE·02:02 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What version should be deployed to remediate this issue?