Is CVE-2026-76233 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76233 being exploited in the wild.

How severe is CVE-2026-76233?

Low severity, with a CVSS score of 3.1, published 13 January 2026.

Which products and versions are affected?

renovate (npm) SEMVER:introduced=39.53.0,fixed=40.33.0.

Is there a fix for CVE-2026-76233?

Yes. renovate (npm): upgrade to 40.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76233 attacked?

It is attacked with local access.

Am I affected by CVE-2026-76233?

Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76233: Renovate arbitrary command injection via gleam manager

CVE-2026-76233 · Severity: low · CVSS 3.1 · Published 2026-01-13

Renovate is a widely-used dependency update automation tool that scans repositories for outdated packages. A vulnerability in its Gleam package manager support allows an attacker with write access to a repository to craft a malicious configuration file that tricks Renovate into executing arbitrary system commands on the machine running it—potentially compromising build servers and CI/CD pipelines.

Technologies: renovate (npm). Vendors: npm.

Quick answers

Is CVE-2026-76233 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76233 being exploited in the wild.
How severe is CVE-2026-76233?: Low severity, with a CVSS score of 3.1, published 13 January 2026.
Which products and versions are affected?: renovate (npm) SEMVER:introduced=39.53.0,fixed=40.33.0.
Is there a fix for CVE-2026-76233?: Yes. renovate (npm): upgrade to 40.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76233 attacked?: It is attacked with local access.
Am I affected by CVE-2026-76233?: Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

renovate (npm): upgrade to 40.33.0 or later
```
npm install renovate@40.33.0
```

Technical details

The vulnerability is a command injection flaw (CWE-77) in the Gleam package manager module (lib/modules/manager/gleam/artifacts.ts). User-controlled dependency names from a malicious gleam.toml file are appended to the `gleam deps update` command without proper shell escaping via the shlex quote function. An attacker with repository write access can craft a gleam.toml with specially-crafted dependency names (e.g., "|| kill 1") that execute arbitrary shell commands when Renovate processes the file. The vulnerability requires the attacker to have write access to a repository configured for Renovate scanning and affects versions 39.53.0 through 40.32.x. The vulnerability has been fixed in version 40.33.0 and later.

Affected products

Renovate Renovate >=39.53.0, <40.33.0

Identifiers

CVE-2026-76233
GHSA-xjr7-3c3g-m763

Timeline

2026-01-13: disclosed: GHSA-xjr7-3c3g-m763 published
2026-01-13: patched: Fix released in version 40.33.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.