# CVE-2026-76231: Renovate arbitrary command injection via hermit manager

Source: https://junglewise.ai/threats/cve-2026-76231-renovate-arbitrary-command-injection-via-hermit-manager  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76231 · Severity: low · CVSS 3.1 · Published 2026-01-13

Renovate is a popular dependency automation tool used by development teams to keep software libraries up-to-date. The tool's hermit package manager feature fails to properly sanitize package names, allowing attackers with repository write access to execute arbitrary system commands with the privileges of the Renovate process. This could lead to unauthorized code execution, data theft, or system compromise on machines running the automation tool.

Technologies: [renovate (npm)](https://junglewise.ai/threats/technologies/renovate). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-76231 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76231 being exploited in the wild.

**How severe is CVE-2026-76231?** Low severity, with a CVSS score of 3.1, published 13 January 2026.

**Which products and versions are affected?** renovate (npm) SEMVER:introduced=32.135.0,fixed=40.33.0.

**Is there a fix for CVE-2026-76231?** Yes. renovate (npm): upgrade to 40.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76231 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-76231?** Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- renovate (npm): upgrade to 40.33.0 or later

  ```sh
  npm install renovate@40.33.0
  ```


## Technical details

The vulnerability is a command injection flaw (CWE-77) in the hermit manager module (lib/modules/manager/hermit/artifacts.ts). User-supplied package names (depName) are concatenated directly into shell commands (./hermit install and ./hermit uninstall) without proper escaping using the shlex.quote() function. This flaw has existed since the hermit manager's introduction in version 32.135.0 (July 2022). A partial fix in version 37.199.1 failed to adequately prevent injection, and the vulnerability was replicated when replacement support was added in version 37.214.4. An attacker with write access to a repository configured for Renovate scanning can craft a malicious hermit dependency name (e.g., "bin/.|| kill 1 ||@0.0.1.pkg") combined with a tweaked renovate.json5 configuration to trigger arbitrary command execution. The PoC demonstrates process termination, but full arbitrary code execution is achievable. The vulnerability requires an attacker with repository write access and affects versions 32.135.0 through 40.32.x; version 40.33.0 and later contain the fix.

## Affected products

- Renovate Renovate >=32.135.0, <40.33.0

## Identifiers

- CVE-2026-76231
- GHSA-36j9-mx87-2cff

## Timeline

- 2026-01-13: disclosed: GHSA advisory published
- 2026-01-13: patched: Fix released in version 40.33.0

## References

- [https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff](https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff)
- [https://github.com/renovatebot/renovate](https://github.com/renovatebot/renovate)

## Related threats

- [Renovate arbitrary command injection via Gradle Wrapper distributionUrl](https://junglewise.ai/threats/cve-2026-76228-renovate-arbitrary-command-injection-via-gradle-wrapper)
- [Renovate remote code execution in bazel-module and bazelisk managers](https://junglewise.ai/threats/cve-2026-76226-renovate-remote-code-execution-in-bazel-module-and-bazelisk)
- [Renovate arbitrary command injection via helmv3 registryAliases](https://junglewise.ai/threats/cve-2024-58376-renovate-arbitrary-command-injection-via-helmv3-registryaliases)
- [Renovate helmv3 command injection via Chart.yaml](https://junglewise.ai/threats/cve-2026-76232-renovate-helmv3-command-injection-via-chart-yaml)
- [Renovate arbitrary command injection via gleam manager](https://junglewise.ai/threats/cve-2026-76233-renovate-arbitrary-command-injection-via-gleam-manager)