CVE-2026-76231CWE-77command-injection

CVE-2026-76231

Medium · published August 19, 2026

CVSS v3.1

6.7

EPSS

Percentile

63.0

In the wild

Unconfirmed

What it is

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate.

The record

Technical detail

CVSS v3.1: 6.7 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 8.4 · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.01019 · 63.0th percentile
Weakness: CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published: 2026-08-19T18:17Z

References (7)

https://github.com/renovatebot/renovate/commit/41e8b99f86a6e2a56f80f7aa1a08a59d76f2358c · [email protected]https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c · [email protected]https://github.com/renovatebot/renovate/commit/b696abb3c2741508fbb4029f39153140a3722e1e · [email protected]https://github.com/renovatebot/renovate/commit/eaec10d7c8afadbdd783ac47bd2adbfab444d6df · [email protected]https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff · [email protected]https://www.vulncheck.com/advisories/renovate-before-command-injection-via-hermit · [email protected]https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

19 AUG 14:02Z
Renovate 32.135.0 before 40.33.0 Command Injection via hermit
cvelistv5