medium6.7
CVE-2026-76231
Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appende…
Impact
Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate.
Affected products
| Product | Affected versions |
|---|---|
| Renovate Versions From 32.135.0 | before 40.33.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/renovatebot/renovate/commit/41e8b99f86a6e2a56f80f7aa1a08a59d76f2358c
- https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c
- https://github.com/renovatebot/renovate/commit/b696abb3c2741508fbb4029f39153140a3722e1e
- https://github.com/renovatebot/renovate/commit/eaec10d7c8afadbdd783ac47bd2adbfab444d6df
- https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff
- https://www.vulncheck.com/advisories/renovate-before-command-injection-via-hermit
- https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff