CVE-2026-76233 renovatebot CVE debrief

Who should care

Defenders responsible for Renovate installations, especially in environments where repository write access is a concern, should assess exposure to this command injection vulnerability.

Why it matters

Defenders should prioritize verifying exposure of Renovate installations to this command injection vulnerability, especially in environments where repository write access is a concern. The vulnerability allows attackers to execute arbitrary commands, making it a high-severity issue.

• Potential execution of arbitrary commands on the machine running Renovate
• Possible malicious activity through crafted gleam.toml files
• Verification of Renovate version and exposure to this vulnerability

Technical summary

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager. The depName parameter is appended to gleam deps update commands without proper sanitization, allowing attackers with repository write access to craft malicious gleam.toml files and execute arbitrary commands. This vulnerability is a high-severity issue, with potential for significant operational impact if exploited. Defenders should prioritize verifying exposure of Renovate installations, especially in environments where repository write access is a concern.

Defensive priority

Defenders should prioritize verifying exposure of Renovate installations to this command injection vulnerability, especially in environments where repository write access is a concern.

Recommended defensive actions

• Verify Renovate installations for exposure to this command injection vulnerability
• Update Renovate to version 40.33.0 or later
• Monitor repository write access and gleam.toml files for potential malicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the command injection vulnerability in Renovate versions before 40.33.0. The vulnerability is in the gleam manager where the depName parameter is not properly sanitized.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.