CVE-2026-76229
Description
A flaw was found in Renovate. This arbitrary command injection vulnerability exists within the kustomize manager, where user-provided chart names are not properly sanitized before being used in helm pull commands. An attacker with write access to a repository can exploit this by crafting malicious kustomization.yaml files with specially designed chart names. This allows them to execute arbitrary commands on the Renovate host machine, leading to arbitrary code execution.
Statement
Red Hat does not ship or use an affected version of Renovate. The vulnerability affects Renovate 39.218.0 up to (but not including) 40.33.0 and was fixed in 40.33.0 (GHSA-5gfg-jpw3-fppq).
Mitigation
Red Hat products are not affected (see statement). Upstream, the issue is resolved by upgrading Renovate to 40.33.0 or later; it can also be mitigated by restricting repository write access so untrusted users cannot introduce a malicious kustomization.yaml.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
