Is CVE-2026-76229 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76229 being exploited in the wild.

How severe is CVE-2026-76229?

Low severity, with a CVSS score of 3.1, published 13 January 2026.

Which products and versions are affected?

renovate (npm) SEMVER:introduced=39.218.0,fixed=40.33.0.

Is there a fix for CVE-2026-76229?

Yes. renovate (npm): upgrade to 40.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76229 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-76229?

Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76229: Renovate arbitrary command injection in kustomize manager

CVE-2026-76229 · Severity: low · CVSS 3.1 · Published 2026-01-13

Renovate is a popular dependency update automation tool used to keep software packages up-to-date. The tool is vulnerable to arbitrary command execution when processing Helm charts via kustomization files, allowing attackers with write access to a monitored repository to execute malicious commands on the machine running Renovate. This could lead to complete compromise of the build/deployment pipeline.

Technologies: renovate (npm). Vendors: npm.

Quick answers

Is CVE-2026-76229 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76229 being exploited in the wild.
How severe is CVE-2026-76229?: Low severity, with a CVSS score of 3.1, published 13 January 2026.
Which products and versions are affected?: renovate (npm) SEMVER:introduced=39.218.0,fixed=40.33.0.
Is there a fix for CVE-2026-76229?: Yes. renovate (npm): upgrade to 40.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76229 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-76229?: Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

renovate (npm): upgrade to 40.33.0 or later
```
npm install renovate@40.33.0
```

Technical details

This is a command injection vulnerability (CWE-77) in the kustomize manager module where user-provided Helm chart names are appended to helm pull commands without proper shell escaping. The vulnerable code in lib/modules/manager/kustomize/artifacts.ts fails to sanitize the depName argument using shlex.quote() before passing it to the shell. An attacker can craft a malicious kustomization.yaml with a chart name containing shell metacharacters (e.g., "example || kill 1; echo") in conjunction with a crafted Helm repository index to achieve arbitrary command execution. The attack requires write access to a repository configured for Renovate scanning, but no user interaction is needed once the malicious config is in place. This vulnerability affects versions 39.218.0 through 40.32.x, with a patch available in version 40.33.0 and later.

Affected products

Renovate Renovate 39.218.0 to 40.32.x

Identifiers

CVE-2026-76229
GHSA-xv56-3wq5-9997

Timeline

2026-01-13: disclosed: Advisory GHSA-xv56-3wq5-9997 published
2026-01-13: patched: Fix available in version 40.33.0 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.