Is CVE-2026-76230 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76230 being exploited in the wild.

How severe is CVE-2026-76230?

Low severity, with a CVSS score of 3.1, published 13 January 2026.

Which products and versions are affected?

renovate (npm) SEMVER:introduced=35.63.0,fixed=40.33.0.

Is there a fix for CVE-2026-76230?

Yes. renovate (npm): upgrade to 40.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76230 attacked?

It is attacked with local access.

Am I affected by CVE-2026-76230?

Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76230: Renovate arbitrary command injection in npm manager

CVE-2026-76230 · Severity: low · CVSS 3.1 · Published 2026-01-13

Renovate is a dependency management automation tool used by development teams to automatically update software dependencies across projects. An attacker with write access to a repository can craft a malicious Renovate configuration file that injects arbitrary commands, allowing them to execute code on the machine running Renovate with the privileges of the Renovate process. This enables unauthorized code execution, data theft, or service disruption on build systems and CI/CD infrastructure.

Technologies: renovate (npm). Vendors: npm.

Quick answers

Is CVE-2026-76230 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76230 being exploited in the wild.
How severe is CVE-2026-76230?: Low severity, with a CVSS score of 3.1, published 13 January 2026.
Which products and versions are affected?: renovate (npm) SEMVER:introduced=35.63.0,fixed=40.33.0.
Is there a fix for CVE-2026-76230?: Yes. renovate (npm): upgrade to 40.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76230 attacked?: It is attacked with local access.
Am I affected by CVE-2026-76230?: Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

renovate (npm): upgrade to 40.33.0 or later
```
npm install renovate@40.33.0
```

Technical details

This is a command injection vulnerability (CWE-77) in Renovate's npm manager module. The vulnerability exists in lib/modules/manager/npm/post-update/npm.ts, where user-controlled package names and workspace identifiers are concatenated into npm install commands without proper shell escaping. An attacker can craft a malicious renovate.json5 configuration file using the overridePackageName or workspace name parameters to break out of the command context and inject arbitrary shell commands. The attack requires write access to a repository configured for Renovate scanning and high privileges on the Renovate runner. The vulnerability has existed since version 35.63.0 (April 2023) and is fixed in version 40.33.0 and later.

Affected products

Renovate Renovate >=35.63.0, <40.33.0

Identifiers

CVE-2026-76230
GHSA-fr4j-65pv-gjjj

Timeline

2026-01-13: disclosed: GHSA-fr4j-65pv-gjjj published
2026-01-13: patched: Fix released in version 40.33.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.