Is CVE-2026-76232 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76232 being exploited in the wild.

How severe is CVE-2026-76232?

Low severity, with a CVSS score of 3.1, published 13 January 2026.

Which products and versions are affected?

renovate (npm) SEMVER:introduced=31.51.0,fixed=40.33.0.

Is there a fix for CVE-2026-76232?

Yes. renovate (npm): upgrade to 40.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76232 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-76232?

Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76232: Renovate helmv3 command injection via Chart.yaml

CVE-2026-76232 · Severity: low · CVSS 3.1 · Published 2026-01-13

Renovate is a dependency automation tool used by development teams to manage package updates across their codebase. An attacker with write access to a repository scanned by Renovate can embed malicious commands in a Chart.yaml file that will be executed on the machine running Renovate, potentially compromising the entire CI/CD system and any data it has access to.

Technologies: renovate (npm). Vendors: npm.

Quick answers

Is CVE-2026-76232 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76232 being exploited in the wild.
How severe is CVE-2026-76232?: Low severity, with a CVSS score of 3.1, published 13 January 2026.
Which products and versions are affected?: renovate (npm) SEMVER:introduced=31.51.0,fixed=40.33.0.
Is there a fix for CVE-2026-76232?: Yes. renovate (npm): upgrade to 40.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76232 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-76232?: Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

renovate (npm): upgrade to 40.33.0 or later
```
npm install renovate@40.33.0
```

Technical details

The helmv3 manager in Renovate appends user-provided repository URLs from Chart.yaml files directly to helm registry login commands without proper shell escaping via the shlex.quote() function. The vulnerable code in lib/modules/manager/helmv3/common.ts fails to sanitize the repository variable before passing it to shell execution, allowing command injection through specially crafted repository URLs (e.g., "oci://charts.bitnami.com/bitnami || kill 1"). An attacker with write access to a repository monitored by Renovate can inject arbitrary commands that execute with the privileges of the Renovate process. The vulnerability requires the attacker to have repository write access and the repository to be configured for Renovate scanning, but requires no user interaction. The issue has existed since version 31.51.0 (released January 2022) and is fixed in version 40.33.0.

Affected products

Renovate renovate >= 31.51.0, < 40.33.0

Identifiers

CVE-2026-76232
GHSA-3f44-xw83-3pmg

Timeline

2026-01-13: disclosed: Advisory GHSA-3f44-xw83-3pmg published
2026-01-24: patched: Patch released in version 40.33.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.