Command Injection in Renovate (CVE-2026-76230)
Summary
Command injection in Renovate (CVE-2026-76230). Successful exploitation can lead to full system takeover.
Original description
The description as published by the source.
Summary
The user-provided string packageName in the npm manager is appended to the npm install command during lock maintenance without proper sanitization.
Details
Adversaries can provide a maliciously crafted Renovate configuration file to trick Renovate to execute arbitrary code.
The user-provided workspace names and package keys that are added to the updateCmd variables in lib/modules/manager/npm/post-update/npm.ts are not being escaped using the quote function from the shlex package.
This lack of proper sanitization has been present in the product since version 35.63.0 (https://github.com/renovatebot/renovate/commit/012c0ac2fe32832e60a62bde405c0a241efd314c), released on April 27 of 2023.
PoC
- Create a git repo with the following content:
renovate.json5:
{
$schema: "https://docs.renovatebot.com/renovate-schema.json",
customDatasources: {
always: {
defaultRegistryUrlTemplate: "https://docs.renovatebot.com/search/search_index.json",
transformTemplates: ['{"releases":[{"version":"11.1.0"}]}'],
},
},
packageRules: [
{
// Target of the day
matchManagers: ["npm"],
// Provide a command in the package name
overridePackageName: "; kill 1; echo ",
// Override the datasource to prevent a lookup failure
overrideDatasource: "custom.always",
},…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-76230 has been found in Renovate.
Successful exploitation can lead to full system takeover. CVSS score: 6.7/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "Renovate CVE-2026-76230" on the vendor's site.
CVE-2026-76230 (Renovate) — CWE-77 / CVSS v3 6.7
Attack vector: local / no user interaction
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-77) exists in Renovate.
Check the vendor advisory for the affected versions of Renovate.
Severity: Medium (CVSS 6.7/10). Successful exploitation can lead to full system takeover.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'Renovate' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'Renovate' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
Renovateを grep し、稼働しているサービス・バージョンを把握する。 -
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- package github.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web github.com
- web disclosure@vulncheck.com
- web nvd.nist.gov
- web github.com