Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-10T13:05:36 renovate: Renovate: Arbitrary Command Execution via crafted Gradle Wrapper distributionUrl 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-78

Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0), the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository's gradle/wrapper/gradle-wrapper.properties file before invoking the Gradle Wrapper CLI. In self-hosted deployments configured with binarySource=docker and allowedUnsafeExecutions=['gradleWrapper', ...], a repository that supplies a crafted distributionUrl (for example, appending a shell metacharacter and command) can cause arbitrary commands to be executed as the Renovate user when Renovate processes a Gradle Wrapper update. The issue is fixed in Renovate 44.14.7; as a workaround, remove 'gradleWrapper' from allowedUnsafeExecutions.

A flaw was found in Renovate. The manager/gradle-wrapper module does not properly escape the distributionUrl value from a repository's gradle/wrapper/gradle-wrapper.properties file. In self-hosted deployments configured with binarySource=docker and allowedUnsafeExecutions=['gradleWrapper', ...], a malicious repository can supply a crafted distributionUrl. This can lead to arbitrary commands being executed as the Renovate user when processing a Gradle Wrapper update.

This is an Important arbitrary command execution flaw in Renovate, affecting self-hosted deployments configured with `binarySource=docker` and `allowedUnsafeExecutions` including `gradleWrapper`. An attacker could exploit this by supplying a crafted `distributionUrl` in a repository's `gradle-wrapper.properties` file, leading to arbitrary command execution as the Renovate user when a Gradle Wrapper update is processed. This could result in a complete compromise of the system running Renovate. To mitigate this vulnerability, remove 'gradleWrapper' from the `allowedUnsafeExecutions` configuration in your Renovate deployment. This prevents the vulnerable code path from being activated. Consult your Renovate deployment documentation for specific instructions on modifying configuration settings. https://www.cve.org/CVERecord?id=CVE-2026-88886 https://nvd.nist.gov/vuln/detail/CVE-2026-88886 https://github.com/renovatebot/renovate/security/advisories/GHSA-7chm-46wx-888m https://www.vulncheck.com/advisories/renovate-before-44.14.7-command-injection-via-gradle-wrapper