CVE-2026-76228
Description
A flaw was found in Renovate. This command injection vulnerability occurs when Renovate processes Gradle Wrapper updates. An attacker can introduce a malicious gradle-wrapper.properties file into a scanned repository, where a specially crafted distributionUrl containing shell command substitution syntax can lead to arbitrary code execution within the Renovate runtime. This allows an attacker to execute unauthorized commands on the system running Renovate.
Statement
Red Hat does not ship or use an affected version of Renovate. The vulnerability affects Renovate 32.124.0 up to (but not including) 42.68.5 and was fixed in 42.68.5 (GHSA-mqp7-cg7m-4hhq).
Mitigation
Red Hat products are not affected (see statement). Upstream, the issue is resolved by upgrading Renovate to 42.68.5 or later (or Mend renovate-ce/renovate-ee to 13.3.0); it can also be mitigated by restricting repository write access so untrusted users cannot introduce a malicious gradle-wrapper.properties.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
