# CVE-2026-76233: Renovate arbitrary command injection via gleam manager

Source: https://junglewise.ai/threats/cve-2026-76233-renovate-arbitrary-command-injection-via-gleam-manager  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76233 · Severity: low · CVSS 3.1 · Published 2026-01-13

Renovate is a widely-used dependency update automation tool that scans repositories for outdated packages. A vulnerability in its Gleam package manager support allows an attacker with write access to a repository to craft a malicious configuration file that tricks Renovate into executing arbitrary system commands on the machine running it—potentially compromising build servers and CI/CD pipelines.

Technologies: [renovate (npm)](https://junglewise.ai/threats/technologies/renovate). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-76233 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76233 being exploited in the wild.

**How severe is CVE-2026-76233?** Low severity, with a CVSS score of 3.1, published 13 January 2026.

**Which products and versions are affected?** renovate (npm) SEMVER:introduced=39.53.0,fixed=40.33.0.

**Is there a fix for CVE-2026-76233?** Yes. renovate (npm): upgrade to 40.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76233 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-76233?** Check whether you run renovate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- renovate (npm): upgrade to 40.33.0 or later

  ```sh
  npm install renovate@40.33.0
  ```


## Technical details

The vulnerability is a command injection flaw (CWE-77) in the Gleam package manager module (lib/modules/manager/gleam/artifacts.ts). User-controlled dependency names from a malicious gleam.toml file are appended to the `gleam deps update` command without proper shell escaping via the shlex quote function. An attacker with repository write access can craft a gleam.toml with specially-crafted dependency names (e.g., "|| kill 1") that execute arbitrary shell commands when Renovate processes the file. The vulnerability requires the attacker to have write access to a repository configured for Renovate scanning and affects versions 39.53.0 through 40.32.x. The vulnerability has been fixed in version 40.33.0 and later.

## Affected products

- Renovate Renovate >=39.53.0, <40.33.0

## Identifiers

- CVE-2026-76233
- GHSA-xjr7-3c3g-m763

## Timeline

- 2026-01-13: disclosed: GHSA-xjr7-3c3g-m763 published
- 2026-01-13: patched: Fix released in version 40.33.0

## References

- [https://github.com/renovatebot/renovate/security/advisories/GHSA-xjr7-3c3g-m763](https://github.com/renovatebot/renovate/security/advisories/GHSA-xjr7-3c3g-m763)
- [https://github.com/renovatebot/renovate](https://github.com/renovatebot/renovate)

## Related threats

- [Renovate arbitrary command injection via Gradle Wrapper distributionUrl](https://junglewise.ai/threats/cve-2026-76228-renovate-arbitrary-command-injection-via-gradle-wrapper)
- [Renovate remote code execution in bazel-module and bazelisk managers](https://junglewise.ai/threats/cve-2026-76226-renovate-remote-code-execution-in-bazel-module-and-bazelisk)
- [Renovate arbitrary command injection via helmv3 registryAliases](https://junglewise.ai/threats/cve-2024-58376-renovate-arbitrary-command-injection-via-helmv3-registryaliases)
- [Renovate helmv3 command injection via Chart.yaml](https://junglewise.ai/threats/cve-2026-76232-renovate-helmv3-command-injection-via-chart-yaml)
- [Renovate arbitrary command injection via hermit manager](https://junglewise.ai/threats/cve-2026-76231-renovate-arbitrary-command-injection-via-hermit-manager)