CVE-2026-76230highCWE-77

Renovate 35.63.0 before 40.33.0 Command Injection via npm

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.4epss 0.9%

probabilidad de explotación

0.9%top 42% de las CVE

explotación observada

noninguna fuente lo reporta

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate.

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

renovatebot · renovate

Referencias

https://github.com/renovatebot/renovate/commit/012c0ac2fe32832e60a62bde405c0a241efd314c https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c https://github.com/renovatebot/renovate/security/advisories/GHSA-fr4j-65pv-gjjj https://www.vulncheck.com/advisories/renovate-before-command-injection-via-npm