CVE-2026-76228 Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper
Attackers can execute arbitrary commands in the Renovate runtime by injecting shell syntax into a Gradle wrapper URL within a scanned repository.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76228?
CVE-2026-76228 is a high-severity command injection vulnerability in mend renovate, published on 19 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url <value>). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled.
Weakness: CWE-78
Which versions are affected by CVE-2026-76228?
2 open source packages ship an affected version, including renovate.
| Package | Affected | Fixed in |
|---|---|---|
renovate npm | From 32.124.0 | 42.68.5 |
renovate npm | From 32.124.0 | 42.68.5 |
How do I fix CVE-2026-76228?
Upgrade renovate to 42.68.5 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-76228 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-76228 exists.
Sources
Also known as GHSA-mqp7-cg7m-4hhq, GHSA-pfq2-hh62-7m96.