CVE-2026-76231: Renovate Hermit Manager RCE Vulnerability

CVE-2026-76231 Overview

CVE-2026-76231 is a command injection vulnerability in Renovate, the automated dependency update tool. The flaw affects Renovate versions from 32.135.0 before 40.33.0 and is located in the hermit manager module. User-provided dependency names are appended directly to install and uninstall shell commands without proper sanitization. Attackers with repository write access can craft maliciously named hermit dependencies to execute arbitrary commands on the machine running Renovate. The weakness is classified under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
Repository contributors with write access can achieve arbitrary command execution on the Renovate host, exposing tokens, source code, and downstream CI/CD infrastructure.

Affected Products

Renovate versions >= 32.135.0 and < 40.33.0
Self-hosted Renovate deployments using the hermit package manager
CI/CD pipelines running affected Renovate versions against untrusted repositories

Discovery Timeline

2026-08-19 - CVE-2026-76231 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76231

Vulnerability Analysis

Renovate's hermit manager handles automated updates for dependencies declared through the Hermit package manager. When Renovate detects a hermit dependency to install or remove, it constructs a shell command that includes the dependency name as an argument. The affected code path does not sanitize or validate the depName value, so shell metacharacters such as ;, |, &&, and command substitution constructs are passed to the shell verbatim.

Because Renovate typically runs with access to Git credentials, package registry tokens, and CI runner secrets, execution of arbitrary commands on the host provides a direct route to secret exfiltration and lateral movement. The vulnerability requires repository write access, but in many organizations this includes a broad set of internal contributors and bots.

Root Cause

The root cause is missing input neutralization on dependency names before they are concatenated into hermit install and uninstall command lines. Renovate treats the manifest-supplied depName as trusted structured data even though it originates from repository content that any writer can modify.

Attack Vector

An attacker with write access to a repository processed by Renovate adds a hermit manifest entry containing shell metacharacters in the dependency name. When Renovate next runs, its hermit manager builds an install or uninstall command with the malicious name embedded, and the shell interprets the injected payload. Execution occurs in the Renovate worker context, which commonly holds Git and registry credentials.

typescript

// Security patch in lib/modules/manager/hermit/artifacts.ts
// fix: add replacementName support for hermit (#27573)

  const toInstall = [];
  const from = [];
+  // storing the old package for replacement
+  const toUninstall = [];

  for (const pkg of update.updatedDeps) {
    if (!pkg.depName || !pkg.currentVersion || !pkg.newValue) {

Source: renovatebot/renovate commit 41e8b99

typescript

// Security patch in lib/modules/manager/api.ts
// feat: add Hermit package manager (#16258)

 import * as helmfile from './helmfile';
 import * as helmsman from './helmsman';
 import * as helmv3 from './helmv3';
+import * as hermit from './hermit';
 import * as homebrew from './homebrew';
 import * as html from './html';
 import * as jenkins from './jenkins';

Source: renovatebot/renovate commit b696abb

Detection Methods for CVE-2026-76231

Indicators of Compromise

Unexpected child processes spawned by the Renovate worker, particularly shells (sh, bash) invoking network utilities such as curl, wget, or nc.
Hermit manifest entries or bin/hermit files containing dependency names with shell metacharacters (;, |, &, backticks, $(...)).
Outbound connections from Renovate CI runners to unexpected hosts during dependency update jobs.
Access to GITHUB_TOKEN, NPM_TOKEN, or Git credential files from processes not part of Renovate's normal execution graph.

Detection Strategies

Inspect Renovate job logs for hermit install or uninstall commands that contain suspicious argument content beyond a normal package name.
Compare hermit manifest changes in pull requests against an allowlist of expected package name characters ([A-Za-z0-9._-]).
Monitor process ancestry on Renovate hosts and alert when Renovate spawns interpreters or reconnaissance tools.

Monitoring Recommendations

Enable command-line auditing (auditd, Sysmon) on all self-hosted Renovate workers and forward events to a central analytics platform.
Track egress traffic from CI runners and baseline expected destinations for Renovate.
Retain Renovate run logs long enough to correlate command execution with the pull request or commit that introduced the malicious dependency name.

How to Mitigate CVE-2026-76231

Immediate Actions Required

Upgrade all Renovate deployments to version 40.33.0 or later, which introduces replacementName handling and sanitizes hermit arguments.
Rotate any credentials, tokens, and SSH keys accessible to Renovate workers if the fixed version was not in place before untrusted contributors gained write access.
Audit recent hermit manifest changes for dependency names containing shell metacharacters.

Patch Information

The fix is delivered across multiple commits in the Renovate repository, including 41e8b99f, a70a6a37, b696abb3, and eaec10d7. See the Renovate GHSA-36j9-mx87-2cff advisory and the VulnCheck advisory for full remediation details.

Workarounds

Disable the hermit manager in Renovate configuration until the upgrade can be applied.
Restrict Renovate to trusted repositories and reduce the set of principals with write access to repositories Renovate scans.
Run Renovate workers in isolated, ephemeral containers with least-privilege credentials scoped per job.

bash

# Disable the hermit manager in renovate.json until patched
{
  "enabledManagers": [
    "npm",
    "dockerfile",
    "gomod"
  ],
  "hermit": {
    "enabled": false
  }
}