Is CVE-2026-76226 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76226 being exploited in the wild.

How severe is CVE-2026-76226?

Medium severity, with a CVSS score of 6.3, published 19 August 2026.

Which products and versions are affected?

renovate (npm) SEMVER:introduced=43.65.0,fixed=43.102.11.

Is there a fix for CVE-2026-76226?

Yes. renovate (npm): upgrade to 43.102.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76226 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-76226?

Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76226: Renovate remote code execution in bazel-module and bazelisk managers

CVE-2026-76226 · Severity: medium · CVSS 6.3 · Published 2026-08-19

Renovate is a popular dependency automation tool used to keep software package versions current across projects. When automatically maintaining lock files using Bazel package managers, a vulnerability allows attackers to execute malicious code on the Renovate server if a dependency update contains attacker-controlled content. This could give attackers access to the build system and any credentials or code it has access to.

Technologies: renovate (npm). Vendors: npm.

Quick answers

Is CVE-2026-76226 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76226 being exploited in the wild.
How severe is CVE-2026-76226?: Medium severity, with a CVSS score of 6.3, published 19 August 2026.
Which products and versions are affected?: renovate (npm) SEMVER:introduced=43.65.0,fixed=43.102.11.
Is there a fix for CVE-2026-76226?: Yes. renovate (npm): upgrade to 43.102.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76226 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-76226?: Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

renovate (npm): upgrade to 43.102.11 or later
```
npm install renovate@43.102.11
```

Technical details

The vulnerability exists in Renovate's lockFileMaintenance feature when using bazel-module or bazelisk managers (versions 43.65.0–43.102.10). The root cause is unsafe execution of Bazel module code that does not properly validate dependencies before passing them to ctx.execute calls. An attacker can craft a malicious dependency package that, when suggested by Renovate as an update, will execute arbitrary code during the bazel mod deps evaluation. The attack requires high privileges (administrator configuration to enable unsafe executions via allowedUnsafeExecutions) but requires no user interaction. The vulnerability is patched in 43.102.11 by adding proper validation and is disabled by default in new deployments.

Affected products

Renovate renovate 43.65.0 through 43.102.10

Identifiers

CVE-2026-76226
GHSA-5vjq-5jmg-39xq

Timeline

2026-04-16: disclosed: Vulnerability published in GHSA-5vjq-5jmg-39xq
2026-04-02: patched: Fix released in version 43.102.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.