# CVE-2026-76228: Renovate arbitrary command injection via Gradle Wrapper distributionUrl

Source: https://junglewise.ai/threats/cve-2026-76228-renovate-arbitrary-command-injection-via-gradle-wrapper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76228 · Severity: medium · CVSS 6.7 · Published 2026-08-19

Renovate is a widely-used dependency automation tool that scans repositories for outdated packages and updates them. A flaw in how Renovate handles Gradle build files allows an attacker to inject arbitrary shell commands through a malicious configuration file. If an attacker can commit a specially crafted file to a repository that Renovate monitors, they can execute code with the privileges of the Renovate service, potentially stealing credentials, modifying repositories, or accessing internal systems.

Technologies: [renovate (npm)](https://junglewise.ai/threats/technologies/renovate). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-76228 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76228 being exploited in the wild.

**How severe is CVE-2026-76228?** Medium severity, with a CVSS score of 6.7, published 19 August 2026.

**Which products and versions are affected?** renovate (npm) SEMVER:introduced=32.124.0,fixed=42.68.5.

**Is there a fix for CVE-2026-76228?** Yes. renovate (npm): upgrade to 42.68.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76228 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-76228?** Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- renovate (npm): upgrade to 42.68.5 or later

  ```sh
  npm install renovate@42.68.5
  ```


## Technical details

The vulnerability is a command injection flaw (CWE-78) in Renovate's Gradle Wrapper manager. When processing Gradle Wrapper updates, Renovate constructs and executes shell commands containing the `distributionUrl` value from gradle-wrapper.properties without proper sanitization. An attacker can inject shell command substitution syntax (e.g., `$(...)`) into this field; the shell evaluates the substitution before Gradle receives the URL string, allowing code execution even though Gradle subsequently fails to parse the malformed URL. The attack requires the attacker to commit a malicious gradle-wrapper.properties file to a repository monitored by Renovate (default behavior). The fix, released in version 42.68.5, eliminates unsafe shell invocation for Gradle and other manager commands.

## Affected products

- Renovate (Mend) Renovate >=32.124.0, <42.68.5

## Identifiers

- CVE-2026-76228
- GHSA-pfq2-hh62-7m96

## Timeline

- 2026-01-13: disclosed: Advisory GHSA-pfq2-hh62-7m96 published
- 2025-12-31: patched: Renovate version 42.68.5 released with fix

## References

- [https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96](https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96)
- [https://github.com/renovatebot/renovate](https://github.com/renovatebot/renovate)

## Related threats

- [Renovate remote code execution in bazel-module and bazelisk managers](https://junglewise.ai/threats/cve-2026-76226-renovate-remote-code-execution-in-bazel-module-and-bazelisk)
- [Renovate arbitrary command injection via helmv3 registryAliases](https://junglewise.ai/threats/cve-2024-58376-renovate-arbitrary-command-injection-via-helmv3-registryaliases)
- [Renovate helmv3 command injection via Chart.yaml](https://junglewise.ai/threats/cve-2026-76232-renovate-helmv3-command-injection-via-chart-yaml)
- [Renovate arbitrary command injection via gleam manager](https://junglewise.ai/threats/cve-2026-76233-renovate-arbitrary-command-injection-via-gleam-manager)
- [Renovate arbitrary command injection via hermit manager](https://junglewise.ai/threats/cve-2026-76231-renovate-arbitrary-command-injection-via-hermit-manager)