CVE-2026-88886 renovatebot CVE debrief

Who should care

Defenders of self-hosted Renovate deployments, especially those with binarySource=docker and allowedUnsafeExecutions=['gradleWrapper'], should assess exposure and prioritize updates or workarounds.

Why it matters

CVE-2026-88886 allows for arbitrary command execution in Renovate's gradle-wrapper module, impacting self-hosted deployments with specific configurations. Defenders should assess exposure, prioritize updates or workarounds, and monitor for potential malicious activity.

• Potential for arbitrary command execution as the Renovate user.
• Risk of unauthorized access and malicious activity in affected deployments.
• Need for immediate remediation or mitigation to prevent exploitation.

Technical summary

The manager/gradle-wrapper module in Renovate does not escape the distributionUrl value from a repository's gradle/wrapper/gradle-wrapper.properties file before invoking the Gradle Wrapper CLI. In self-hosted deployments with binarySource=docker and allowedUnsafeExecutions=['gradleWrapper'], a crafted distributionUrl can lead to arbitrary command execution. This issue affects Renovate versions before 44.14.7 and certain Mend Renovate CE/EE distributions. The vulnerability can be mitigated by removing 'gradleWrapper' from allowedUnsafeExecutions or updating Renovate to version 44.14.7 or later. It is also recommended to review and restrict repository access to prevent crafted distributionUrl values.

Defensive priority

High priority for systems using Renovate in self-hosted deployments with binarySource=docker and allowedUnsafeExecutions=['gradleWrapper'].

Recommended defensive actions

• Remove 'gradleWrapper' from allowedUnsafeExecutions in self-hosted deployments.
• Update Renovate to version 44.14.7 or later.
• Review and restrict repository access to prevent crafted distributionUrl values.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in Renovate versions before 44.14.7 and certain Mend Renovate CE/EE distributions. A crafted distributionUrl in a repository's gradle/wrapper/gradle-wrapper.properties file can lead to arbitrary command execution as the Renovate user.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.