CVE-2026-88886: Renovate command injection in Gradle Wrapper module

CVE-2026-88886 · Severity: high · CVSS 7.8 · Published 2026-09-10

Renovate is an open-source dependency update automation tool used to automatically update software libraries and dependencies in code repositories. A vulnerability in the Gradle Wrapper component allows attackers to execute arbitrary commands on a server running Renovate, potentially gaining full control of the system and stealing sensitive data. This only affects self-hosted deployments with specific security configurations enabled.

Technologies: mend-renovate-enterprise-edition Helm Chart, Mend Renovate EE, Mend Renovate-Ce. Vendors: Mend.

Quick answers

Is CVE-2026-88886 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88886 being exploited in the wild.
How severe is CVE-2026-88886?
High severity, with a CVSS score of 7.8, published 10 September 2026.
Which products and versions are affected?
mend-renovate-enterprise-edition Helm Chart before 10.4.0; Mend Renovate EE before 15.4.0; Mend Renovate-Ce before 15.4.0.
Is there a fix for CVE-2026-88886?
A patch was published on 2026-09-10: Renovate 44.14.7, Mend Renovate CE/EE 15.4.0, and mend-renovate-enterprise-edition Helm chart 10.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88886 attacked?
It is attacked with local access.
Am I affected by CVE-2026-88886?
Check whether you run mend-renovate-enterprise-edition Helm Chart, Mend Renovate EE or Mend Renovate-Ce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection (CWE-78) in the manager/gradle-wrapper module. When Renovate processes Gradle Wrapper updates, it reads the distributionUrl value from a repository's gradle/wrapper/gradle-wrapper.properties file but fails to escape shell metacharacters before passing it to the Gradle Wrapper CLI. An attacker controlling a target repository can craft a malicious distributionUrl containing shell commands (e.g., "https://example.com/gradle.zip ; cp /etc/passwd /tmp/passwd") that execute with the privileges of the Renovate user. This requires the victim to run Renovate in self-hosted mode with binarySource=docker and allowedUnsafeExecutions=['gradleWrapper', ...]. The vulnerability is fixed in Renovate 44.14.7 and Mend Renovate CE/EE 15.4.0; users can mitigate by removing gradleWrapper from allowedUnsafeExecutions.

Affected products

  • Renovate Renovate before 44.14.7
  • Mend Renovate CE before 15.4.0
  • Mend Renovate EE before 15.4.0
  • Mend mend-renovate-enterprise-edition Helm chart before 10.4.0

Timeline

  • 2026-09-10: disclosed
  • 2026-09-10: patched: Renovate 44.14.7, Mend Renovate CE/EE 15.4.0, and mend-renovate-enterprise-edition Helm chart 10.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.