CVE-2026-76233: Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager
Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Renovateto a version that resolves this vulnerability.Fixed in 40.33.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs write access to a repository processed by Renovate. They can craft a malicious gleam.toml file so that its depName value injects commands into Renovate's Gleam dependency update operation.
What systems are at risk?
The affected system is the machine running Renovate, rather than only the repository itself. Successful exploitation can execute arbitrary commands on that machine with the privileges of the Renovate process.
Which Renovate versions are affected?
Versions from 39.53.0 up to, but not including, 40.33.0 are affected.