CVE-2026-76228
mediumpriority · track · 0EPSS 0.010 · 61 %ileUSEPSS · scored 2026-10-28
Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url <value>). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.7–8.4
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (1)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-pfq2-hh62-7m96Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`2026-01-13ghsa · osvUS
### Summary Renovate can be tricked into executing shell code while updating the Gradle Wrapper. A malicious `distributionUrl` in `gradle/wrapper/gradle-wrapper.properties` can lead to command execution in the Renovate runtime. ### Details When Renovate handles Gradle Wrapper artifacts, it may run a wrapper update command such as: - `./gradlew :wrapper --gradle-distribution-url <value>` In the observed behavior, Renovate executes this via a shell (e.g., `/bin/sh -c ...`). If `distributionUrl` contains shell command substitution syntax like `$(...)`, the shell evaluates it **before** Gradle validates/parses the URL. After that, Gradle attempts to parse the URL as a URI and fails with `URISyntaxException`, but the shell substitution has already executed. This is reproducible even when `allowScripts` is disabled (default is OFF), because this execution happens as part of Gradle Wrapper artifact handling rather than “repository install scripts”. Prerequisites / attack conditions: - The attacker must be able to get a malicious `gradle-wrapper.properties` into a repository that Renovate scans (e.g., direct write access, or a maintainer merges an attacker’s change/PR). - Renovate must be configured to process Gradle Wrapper updates/artifacts for that repository (default behavior for the Gradle Wrapper manager). ### PoC 1. Create a repository with a Gradle Wrapper (`gradlew`, `gradlew.bat`, `gradle/wrapper/gradle-wrapper.jar`, and `gradle/wrapper/gradle-wrapper.properties`). 2. Set `distributionUrl` in `gradle-wrapper.properties` to include `$(...)`. 3. Run Renovate against the repository. 4. Observe that a file is created during Renovate’s wrapper update step **before** Gradle fails with `URISyntaxException`. A [screen recording](https://drive.google.com/file/d/1nveSCgyz4pKPCZuelqDD_xGEO00DXr4P/view) is attached showing end-to-end reproduction. In the demo, the payload creates `/tmp/passwd_dump` containing `/etc/passwd`, demonstrating that file read/exfiltration is possible within the Renovate execution context. ### Impact This allows arbitrary command execution in the Renovate runtime during Gradle Wrapper updates. Depending on deployment, this may expose credentials/tokens available to the bot and may allow an attacker to modify repositories or access internal resources reachable from the Renovate environment. ### Remediation Upgrading to Renovate [42.68.5](https://github.com/renovatebot/renovate/releases/tag/42.68.5) (2025-12-31) fixes this issue, and closes out other risks of shell evaluation for commands run by Renovate. If using the `composer`, `yarn` (v1) or `flux` managers, please upgrade to [42.74.5](https://github.com/renovatebot/renovate/releases/tag/42.74.5) (2026-01-08), as there were follow-up fixes to keep these managers working.
sources
Which sources assert this record, and when.
references (2) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan