# CVE-2026-76226: Renovate remote code execution in bazel-module and bazelisk managers

Source: https://junglewise.ai/threats/cve-2026-76226-renovate-remote-code-execution-in-bazel-module-and-bazelisk  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76226 · Severity: medium · CVSS 6.3 · Published 2026-08-19

Renovate is a popular dependency automation tool used to keep software package versions current across projects. When automatically maintaining lock files using Bazel package managers, a vulnerability allows attackers to execute malicious code on the Renovate server if a dependency update contains attacker-controlled content. This could give attackers access to the build system and any credentials or code it has access to.

Technologies: [renovate (npm)](https://junglewise.ai/threats/technologies/renovate). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-76226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76226 being exploited in the wild.

**How severe is CVE-2026-76226?** Medium severity, with a CVSS score of 6.3, published 19 August 2026.

**Which products and versions are affected?** renovate (npm) SEMVER:introduced=43.65.0,fixed=43.102.11.

**Is there a fix for CVE-2026-76226?** Yes. renovate (npm): upgrade to 43.102.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76226 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-76226?** Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- renovate (npm): upgrade to 43.102.11 or later

  ```sh
  npm install renovate@43.102.11
  ```


## Technical details

The vulnerability exists in Renovate's lockFileMaintenance feature when using bazel-module or bazelisk managers (versions 43.65.0–43.102.10). The root cause is unsafe execution of Bazel module code that does not properly validate dependencies before passing them to ctx.execute calls. An attacker can craft a malicious dependency package that, when suggested by Renovate as an update, will execute arbitrary code during the bazel mod deps evaluation. The attack requires high privileges (administrator configuration to enable unsafe executions via allowedUnsafeExecutions) but requires no user interaction. The vulnerability is patched in 43.102.11 by adding proper validation and is disabled by default in new deployments.

## Affected products

- Renovate renovate 43.65.0 through 43.102.10

## Identifiers

- CVE-2026-76226
- GHSA-5vjq-5jmg-39xq

## Timeline

- 2026-04-16: disclosed: Vulnerability published in GHSA-5vjq-5jmg-39xq
- 2026-04-02: patched: Fix released in version 43.102.11

## References

- [https://github.com/renovatebot/renovate/security/advisories/GHSA-5vjq-5jmg-39xq](https://github.com/renovatebot/renovate/security/advisories/GHSA-5vjq-5jmg-39xq)
- [https://github.com/renovatebot/renovate](https://github.com/renovatebot/renovate)
- [https://github.com/renovatebot/renovate/releases/tag/43.102.11](https://github.com/renovatebot/renovate/releases/tag/43.102.11)

## Related threats

- [Renovate arbitrary command injection via Gradle Wrapper distributionUrl](https://junglewise.ai/threats/cve-2026-76228-renovate-arbitrary-command-injection-via-gradle-wrapper)
- [Renovate arbitrary command injection via helmv3 registryAliases](https://junglewise.ai/threats/cve-2024-58376-renovate-arbitrary-command-injection-via-helmv3-registryaliases)
- [Renovate helmv3 command injection via Chart.yaml](https://junglewise.ai/threats/cve-2026-76232-renovate-helmv3-command-injection-via-chart-yaml)
- [Renovate arbitrary command injection via gleam manager](https://junglewise.ai/threats/cve-2026-76233-renovate-arbitrary-command-injection-via-gleam-manager)
- [Renovate arbitrary command injection via hermit manager](https://junglewise.ai/threats/cve-2026-76231-renovate-arbitrary-command-injection-via-hermit-manager)