CVE-2026-76233
Received Received - Intake

Command Injection in Renovate Dependency Manager

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76233
EUVD
EUVD-2026-62474

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
renovate renovate to 40.33.0 (exc)
renovatebot renovate From 39.53.0 (inc) to 40.33.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Renovate versions 39.53.0 to 40.33.0 have a command injection flaw in the gleam manager. The depName parameter is added to gleam deps update commands without sanitization. Attackers with repository write access can insert malicious gleam.toml files to run arbitrary commands on the Renovate host machine.

Detection Guidance

Check Renovate logs for suspicious gleam deps update commands or unexpected command executions. Review gleam.toml files in repositories for malicious depName values. Monitor system processes for unauthorized commands spawned by Renovate.

Impact Analysis

If you use affected Renovate versions and an attacker gains repository write access, they could execute arbitrary commands on your Renovate server. This could lead to data theft, system compromise, or further network infiltration depending on the server's permissions.

Compliance Impact

This vulnerability could lead to unauthorized command execution, potentially exposing sensitive data. This may violate GDPR (data protection) or HIPAA (health data security) if personal or health information is compromised due to the breach.

Mitigation Strategies

Upgrade Renovate to version 40.33.0 or later. Restrict repository write access to trusted users. Audit existing gleam.toml files for malicious entries. Implement input validation for depName parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76233. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart