Is CVE-2026-76228 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76228 being exploited in the wild.

How severe is CVE-2026-76228?

Medium severity, with a CVSS score of 6.7, published 19 August 2026.

Which products and versions are affected?

renovate (npm) SEMVER:introduced=32.124.0,fixed=42.68.5.

Is there a fix for CVE-2026-76228?

Yes. renovate (npm): upgrade to 42.68.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76228 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-76228?

Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76228: Renovate arbitrary command injection via Gradle Wrapper distributionUrl

CVE-2026-76228 · Severity: medium · CVSS 6.7 · Published 2026-08-19

Renovate is a widely-used dependency automation tool that scans repositories for outdated packages and updates them. A flaw in how Renovate handles Gradle build files allows an attacker to inject arbitrary shell commands through a malicious configuration file. If an attacker can commit a specially crafted file to a repository that Renovate monitors, they can execute code with the privileges of the Renovate service, potentially stealing credentials, modifying repositories, or accessing internal systems.

Technologies: renovate (npm). Vendors: npm.

Quick answers

Is CVE-2026-76228 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76228 being exploited in the wild.
How severe is CVE-2026-76228?: Medium severity, with a CVSS score of 6.7, published 19 August 2026.
Which products and versions are affected?: renovate (npm) SEMVER:introduced=32.124.0,fixed=42.68.5.
Is there a fix for CVE-2026-76228?: Yes. renovate (npm): upgrade to 42.68.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76228 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-76228?: Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

renovate (npm): upgrade to 42.68.5 or later
```
npm install renovate@42.68.5
```

Technical details

The vulnerability is a command injection flaw (CWE-78) in Renovate's Gradle Wrapper manager. When processing Gradle Wrapper updates, Renovate constructs and executes shell commands containing the `distributionUrl` value from gradle-wrapper.properties without proper sanitization. An attacker can inject shell command substitution syntax (e.g., `$(...)`) into this field; the shell evaluates the substitution before Gradle receives the URL string, allowing code execution even though Gradle subsequently fails to parse the malformed URL. The attack requires the attacker to commit a malicious gradle-wrapper.properties file to a repository monitored by Renovate (default behavior). The fix, released in version 42.68.5, eliminates unsafe shell invocation for Gradle and other manager commands.

Affected products

Renovate (Mend) Renovate >=32.124.0, <42.68.5

Identifiers

CVE-2026-76228
GHSA-pfq2-hh62-7m96

Timeline

2026-01-13: disclosed: Advisory GHSA-pfq2-hh62-7m96 published
2025-12-31: patched: Renovate version 42.68.5 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.