CVE-2026-76231highCWE-77

CVE-2026-76231: falha de alta gravidade em renovatebot renovate

Renovate 32.135.0 before 40.33.0 Command Injection via hermit

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar renovate+ Monitorar renovate

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.4epss 1.0%
Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate.
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
renovatebot · renovate
CVEs relacionadas — renovatebot renovate

No mesmo produto, das mais perigosas para as menos.

CVE-2026-88889HIGHRenovate before 44.14.7 Command Injection via distributionTypeEPSS 1.0%CVE-2026-76232HIGHRenovate 31.51.0 before 40.33.0 Command Injection via helmv3EPSS 1.0%CVE-2026-76230HIGHRenovate 35.63.0 before 40.33.0 Command Injection via npmEPSS 1.0%CVE-2026-76233HIGHRenovate 39.53.0 before 40.33.0 Command Injection via gleam managerEPSS 1.0%CVE-2026-76229HIGHRenovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomizeEPSS 1.0%CVE-2026-76228HIGHRenovate before 42.68.5 Remote Code Execution via Gradle WrapperEPSS 1.0%