# CVE-2026-88886: Renovate command injection in Gradle Wrapper module

Source: https://junglewise.ai/threats/cve-2026-88886-renovate-command-injection-in-gradle-wrapper-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88886 · Severity: high · CVSS 7.8 · Published 2026-09-10

Renovate is an open-source dependency update automation tool used to automatically update software libraries and dependencies in code repositories. A vulnerability in the Gradle Wrapper component allows attackers to execute arbitrary commands on a server running Renovate, potentially gaining full control of the system and stealing sensitive data. This only affects self-hosted deployments with specific security configurations enabled.

Technologies: [mend-renovate-enterprise-edition Helm Chart](https://junglewise.ai/threats/technologies/mend-renovate-enterprise-edition-helm-chart), [Mend Renovate EE](https://junglewise.ai/threats/technologies/renovate-ee), [Mend Renovate-Ce](https://junglewise.ai/threats/technologies/renovate-ce). Vendors: [Mend](https://junglewise.ai/threats/vendors/mend).

## Quick answers

**Is CVE-2026-88886 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88886 being exploited in the wild.

**How severe is CVE-2026-88886?** High severity, with a CVSS score of 7.8, published 10 September 2026.

**Which products and versions are affected?** mend-renovate-enterprise-edition Helm Chart before 10.4.0; Mend Renovate EE before 15.4.0; Mend Renovate-Ce before 15.4.0.

**Is there a fix for CVE-2026-88886?** A patch was published on 2026-09-10: Renovate 44.14.7, Mend Renovate CE/EE 15.4.0, and mend-renovate-enterprise-edition Helm chart 10.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88886 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-88886?** Check whether you run mend-renovate-enterprise-edition Helm Chart, Mend Renovate EE or Mend Renovate-Ce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an OS command injection (CWE-78) in the manager/gradle-wrapper module. When Renovate processes Gradle Wrapper updates, it reads the distributionUrl value from a repository's gradle/wrapper/gradle-wrapper.properties file but fails to escape shell metacharacters before passing it to the Gradle Wrapper CLI. An attacker controlling a target repository can craft a malicious distributionUrl containing shell commands (e.g., "https://example.com/gradle.zip ; cp /etc/passwd /tmp/passwd") that execute with the privileges of the Renovate user. This requires the victim to run Renovate in self-hosted mode with binarySource=docker and allowedUnsafeExecutions=['gradleWrapper', ...]. The vulnerability is fixed in Renovate 44.14.7 and Mend Renovate CE/EE 15.4.0; users can mitigate by removing gradleWrapper from allowedUnsafeExecutions.

## Affected products

- Renovate Renovate before 44.14.7
- Mend Renovate CE before 15.4.0
- Mend Renovate EE before 15.4.0
- Mend mend-renovate-enterprise-edition Helm chart before 10.4.0

## Timeline

- 2026-09-10: disclosed
- 2026-09-10: patched: Renovate 44.14.7, Mend Renovate CE/EE 15.4.0, and mend-renovate-enterprise-edition Helm chart 10.4.0

## References

- [https://github.com/renovatebot/renovate/security/advisories/GHSA-7chm-46wx-888m](https://github.com/renovatebot/renovate/security/advisories/GHSA-7chm-46wx-888m)
- [https://www.vulncheck.com/advisories/renovate-before-44.14.7-command-injection-via-gradle-wrapper](https://www.vulncheck.com/advisories/renovate-before-44.14.7-command-injection-via-gradle-wrapper)

## Related threats

- [Renovate server-side request forgery in HTTP presets](https://junglewise.ai/threats/cve-2026-110868-renovate-before-44-79-0-contains-a-server-side-request-forgery)
- [Renovate environment variable allowlist bypass in shared presets](https://junglewise.ai/threats/cve-2026-110867-renovate-before-44-60-1-contains-an-allowlist-bypass)
- [Renovate protection mechanism bypass in minimumReleaseAge checks](https://junglewise.ai/threats/cve-2026-110866-renovate-before-44-61-3-contains-a-protection-mechanism-bypass)
- [Renovate HTTP header allowlist bypass in shared presets](https://junglewise.ai/threats/cve-2026-110865-renovate-before-44-60-1-contains-an-allowlist-bypass)
- [Renovate command injection in Maven Wrapper manager](https://junglewise.ai/threats/cve-2026-88889-renovate-command-injection-in-maven-wrapper-manager)