# CVE-2026-76230: Renovate arbitrary command injection in npm manager

Source: https://junglewise.ai/threats/cve-2026-76230-renovate-arbitrary-command-injection-in-npm-manager  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76230 · Severity: low · CVSS 3.1 · Published 2026-01-13

Renovate is a dependency management automation tool used by development teams to automatically update software dependencies across projects. An attacker with write access to a repository can craft a malicious Renovate configuration file that injects arbitrary commands, allowing them to execute code on the machine running Renovate with the privileges of the Renovate process. This enables unauthorized code execution, data theft, or service disruption on build systems and CI/CD infrastructure.

Technologies: [renovate (npm)](https://junglewise.ai/threats/technologies/renovate). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-76230 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76230 being exploited in the wild.

**How severe is CVE-2026-76230?** Low severity, with a CVSS score of 3.1, published 13 January 2026.

**Which products and versions are affected?** renovate (npm) SEMVER:introduced=35.63.0,fixed=40.33.0.

**Is there a fix for CVE-2026-76230?** Yes. renovate (npm): upgrade to 40.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76230 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-76230?** Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- renovate (npm): upgrade to 40.33.0 or later

  ```sh
  npm install renovate@40.33.0
  ```


## Technical details

This is a command injection vulnerability (CWE-77) in Renovate's npm manager module. The vulnerability exists in lib/modules/manager/npm/post-update/npm.ts, where user-controlled package names and workspace identifiers are concatenated into npm install commands without proper shell escaping. An attacker can craft a malicious renovate.json5 configuration file using the overridePackageName or workspace name parameters to break out of the command context and inject arbitrary shell commands. The attack requires write access to a repository configured for Renovate scanning and high privileges on the Renovate runner. The vulnerability has existed since version 35.63.0 (April 2023) and is fixed in version 40.33.0 and later.

## Affected products

- Renovate Renovate >=35.63.0, <40.33.0

## Identifiers

- CVE-2026-76230
- GHSA-fr4j-65pv-gjjj

## Timeline

- 2026-01-13: disclosed: GHSA-fr4j-65pv-gjjj published
- 2026-01-13: patched: Fix released in version 40.33.0

## References

- [https://github.com/renovatebot/renovate/security/advisories/GHSA-fr4j-65pv-gjjj](https://github.com/renovatebot/renovate/security/advisories/GHSA-fr4j-65pv-gjjj)
- [https://github.com/renovatebot/renovate](https://github.com/renovatebot/renovate)

## Related threats

- [Renovate arbitrary command injection via Gradle Wrapper distributionUrl](https://junglewise.ai/threats/cve-2026-76228-renovate-arbitrary-command-injection-via-gradle-wrapper)
- [Renovate remote code execution in bazel-module and bazelisk managers](https://junglewise.ai/threats/cve-2026-76226-renovate-remote-code-execution-in-bazel-module-and-bazelisk)
- [Renovate arbitrary command injection via helmv3 registryAliases](https://junglewise.ai/threats/cve-2024-58376-renovate-arbitrary-command-injection-via-helmv3-registryaliases)
- [Renovate helmv3 command injection via Chart.yaml](https://junglewise.ai/threats/cve-2026-76232-renovate-helmv3-command-injection-via-chart-yaml)
- [Renovate arbitrary command injection via gleam manager](https://junglewise.ai/threats/cve-2026-76233-renovate-arbitrary-command-injection-via-gleam-manager)