CVE-2026-76230: Renovate npm Manager RCE Vulnerability

CVE-2026-76230 Overview

CVE-2026-76230 is a command injection vulnerability in Renovate, the automated dependency update tool from Mend. Affected versions from 35.63.0 before 40.33.0 fail to sanitize user-provided packageName values before appending them to npm install commands. An attacker with write access to a monitored repository can craft a malicious Renovate configuration file to execute arbitrary commands on the host running Renovate. The flaw is tracked as CWE-77: Improper Neutralization of Special Elements used in a Command and is documented in the GitHub Security Advisory GHSA-fr4j-65pv-gjjj.

Critical Impact
Attackers with repository write access can execute arbitrary commands on the Renovate runner, enabling lateral movement, secret theft, and CI/CD pipeline compromise.

Affected Products

Renovate versions from 35.63.0 before 40.33.0
Self-hosted Renovate deployments running the vulnerable npm manager
Renovate CI/CD pipelines integrated with npm-based repositories

Discovery Timeline

2026-08-19 - CVE-2026-76230 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-76230

Vulnerability Analysis

Renovate scans repositories for dependency updates and invokes package manager commands to compute lockfile changes. In the npm manager, the packageName value derived from Renovate configuration is concatenated into an npm install command string without shell escaping or allowlist validation. Because Renovate configuration files such as renovate.json and package.json reside inside the target repository, any user with write access can control this value. When Renovate runs against the repository, the crafted packageName breaks out of the intended argument boundary and injects additional shell commands into the process. Execution occurs with the privileges of the Renovate worker, which typically holds tokens for source control, container registries, and downstream package repositories.

Root Cause

The root cause is unsafe command construction in the npm manager module. User-controlled packageName strings flow into a shell command without being sanitized, quoted, or passed as a discrete argv element. This is a classic [CWE-77] command injection pattern where trust in configuration data was assumed rather than enforced.

Attack Vector

An attacker submits a pull request or direct commit that sets packageName to a value containing shell metacharacters. When Renovate processes the repository, the injected payload executes on the runner. Exploitation requires repository write access, aligning with the local attack vector and high privileges required indicated by the CVSS vector.

typescript

// Security patch: lib/util/package-rules/index.ts introduces
// controlled overrides (overrideDatasource, overrideDepName,
// overridePackageName) via a template compilation step, replacing
// direct interpolation of user-controlled packageName values.
import type { PackageRule, PackageRuleInputConfig } from '../../config/types';
import { logger } from '../../logger';
import type { StageName } from '../../types/skip-reason';
import { compile } from '../template';
import matchers from './matchers';

async function matchesRule(
// Source: https://github.com/renovatebot/renovate/commit/a70a6a376d31148e80be5a5c885ac33ff5ddb30c

Detection Methods for CVE-2026-76230

Indicators of Compromise

Unexpected child processes spawned by the Renovate worker, especially sh, bash, curl, wget, or nc executed under the npm manager context.
Renovate log entries containing shell metacharacters (;, &&, |, backticks, $()) inside packageName fields.
Outbound network connections from CI runners to non-registry destinations during dependency update jobs.
Access or exfiltration of CI secrets, GITHUB_TOKEN, or npm publish tokens during a Renovate run.

Detection Strategies

Inspect Renovate configuration files in pull requests for packageName values containing shell metacharacters or unusual whitespace.
Correlate Renovate job execution telemetry with process creation events on the runner to identify anomalous descendants of npm install.
Alert on Renovate processes that write outside expected working directories or spawn interpreters not required for dependency resolution.

Monitoring Recommendations

Enable verbose Renovate logging and forward it to a centralized log platform for retention and search.
Monitor CI/CD runner egress and flag connections to hosts not on an approved registry allowlist.
Track version drift across self-hosted Renovate deployments to ensure all instances have reached 40.33.0 or later.

How to Mitigate CVE-2026-76230

Immediate Actions Required

Upgrade Renovate to version 40.33.0 or later on all self-hosted deployments and container images.
Audit repositories with write access exposed to untrusted contributors and review recent Renovate runs for signs of exploitation.
Rotate any credentials, tokens, or SSH keys accessible to the Renovate worker if compromise is suspected.

Patch Information

The fix is delivered in Renovate 40.33.0 through commits 012c0ac2fe32832e60a62bde405c0a241efd314c and a70a6a376d31148e80be5a5c885ac33ff5ddb30c. Additional context is available in the VulnCheck advisory and the GitHub Security Advisory GHSA-fr4j-65pv-gjjj.

Workarounds

Restrict repository write access to trusted contributors until the upgrade is complete.
Run Renovate inside an ephemeral, network-restricted container with least-privilege tokens scoped to a single repository.
Disable the npm manager for repositories that do not require JavaScript dependency updates by setting "npm": { "enabled": false } in the Renovate configuration.

bash

# Upgrade the self-hosted Renovate CLI to a patched release
npm install -g renovate@40.33.0

# Verify the installed version is 40.33.0 or later
renovate --version

# For containerized deployments, pin the patched image tag
docker pull renovate/renovate:40.33.0