Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-19T14:02:10 renovate: Renovate: Arbitrary Code Execution via malicious Gradle Wrapper properties 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CWE-78

Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url <value>). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled.

A flaw was found in Renovate. This command injection vulnerability occurs when Renovate processes Gradle Wrapper updates. An attacker can introduce a malicious `gradle-wrapper.properties` file into a scanned repository, where a specially crafted `distributionUrl` containing shell command substitution syntax can lead to arbitrary code execution within the Renovate runtime. This allows an attacker to execute unauthorized commands on the system running Renovate.

Red Hat does not ship or use an affected version of Renovate. The vulnerability affects Renovate 32.124.0 up to (but not including) 42.68.5 and was fixed in 42.68.5 (GHSA-mqp7-cg7m-4hhq). Red Hat products are not affected (see statement). Upstream, the issue is resolved by upgrading Renovate to 42.68.5 or later (or Mend renovate-ce/renovate-ee to 13.3.0); it can also be mitigated by restricting repository write access so untrusted users cannot introduce a malicious gradle-wrapper.properties. https://www.cve.org/CVERecord?id=CVE-2026-76228 https://nvd.nist.gov/vuln/detail/CVE-2026-76228 https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96 https://www.vulncheck.com/advisories/renovate-before-remote-code-execution-via-gradle-wrapper