CVE-2026-76233: Renovate Gleam Manager RCE Vulnerability

CVE-2026-76233 Overview

CVE-2026-76233 is a command injection vulnerability [CWE-77] in Renovate, the automated dependency update tool. Affected versions range from 39.53.0 up to (but not including) 40.33.0. The flaw resides in the gleam manager, where the depName parameter is concatenated into gleam deps update commands without sanitization. Attackers with repository write access can craft a malicious gleam.toml file that injects arbitrary shell commands. When Renovate processes the repository, those commands execute on the host running the Renovate job.

Critical Impact
An attacker with repository write access can achieve arbitrary command execution on the Renovate host, exposing CI/CD secrets, source code, and downstream infrastructure.

Affected Products

Renovate >= 39.53.0
Renovate < 40.33.0
Self-hosted and Mend-hosted Renovate deployments processing Gleam projects

Discovery Timeline

2026-08-19 - CVE-2026-76233 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-76233

Vulnerability Analysis

Renovate's gleam manager builds lockfiles by invoking the gleam CLI as a child process. The updated code path constructs an update command by joining gleam deps update with a list of package names taken from dependency metadata parsed out of gleam.toml. Because that list is interpolated directly into a shell command string, any shell metacharacter in a dependency name is passed to the shell interpreter. A crafted dependency name containing characters such as ;, &&, or ` executes attacker-controlled commands under the identity of the Renovate worker. The Renovate worker typically holds Git credentials, registry tokens, and pipeline secrets, which makes host-level command execution equivalent to full CI/CD compromise.

Root Cause

The root cause is unsafe command construction in lib/modules/manager/gleam/artifacts.ts. Dependency names are collected via updatedDeps.map((dep) => dep.depName) and joined into a single command string that is passed to exec. No allowlist, quoting, or argv-style execution separates arguments from the command interpreter. This maps to [CWE-77] Improper Neutralization of Special Elements used in a Command.

Attack Vector

Exploitation requires write access to a repository that Renovate scans. The attacker commits a gleam.toml file whose dependency identifiers contain shell metacharacters. On the next Renovate run, the gleam manager parses the manifest, includes the malicious name in the gleam deps update invocation, and the shell evaluates the injected payload. Execution occurs locally on the Renovate host with the privileges of the Renovate process.

typescript

       ],
     };
 
-    await exec('gleam deps download', execOptions);
+    // `gleam deps update` with no packages rebuilds the lock file
+    const packagesToUpdate = isLockFileMaintenance
+      ? []
+      : updatedDeps.map((dep) => dep.depName).filter(Boolean);
+
+    const updateCommand = ['gleam deps update', ...packagesToUpdate].join(' ');
+    await exec(updateCommand, execOptions);
     const newLockFileContent = await readLocalFile(lockFileName, 'utf8');
     if (!newLockFileContent) {
       logger.debug(`No ${lockFileName} found`);

Source: Renovate commit d29698e. The patch commit shows how depName values flow into the joined command string; the follow-on fix introduces sanitization and safer argument handling.

Detection Methods for CVE-2026-76233

Indicators of Compromise

Unexpected child processes spawned by the Renovate worker such as /bin/sh, bash -c, curl, wget, or nc following a gleam deps update invocation.
gleam.toml files containing dependency names with shell metacharacters (;, |, &, `, $(, newlines).
Outbound network connections from CI runners to unrecognized hosts immediately after a Renovate job starts.
New or modified SSH keys, tokens, or environment dump files on hosts running Renovate.

Detection Strategies

Inspect Renovate job logs for gleam deps update command strings that contain characters outside [A-Za-z0-9_./-].
Compare deployed Renovate versions against the fixed release 40.33.0 using SBOM or package inventories.
Alert on process lineage where renovate or node is the parent of shells that execute reconnaissance or exfiltration binaries.

Monitoring Recommendations

Forward CI runner and Renovate container process telemetry to a centralized SIEM for lineage analysis.
Monitor secret stores and Git provider audit logs for token use originating from Renovate hosts outside expected windows.
Track changes to gleam.toml in all repositories eligible for Renovate scans and flag additions of unusual characters in dependency names.

How to Mitigate CVE-2026-76233

Immediate Actions Required

Upgrade Renovate to version 40.33.0 or later on all self-hosted deployments and container images.
Rotate any credentials, tokens, and SSH keys accessible to the Renovate worker if vulnerable versions ran against untrusted repositories.
Restrict repository write access on projects that Renovate scans to trusted maintainers only.
Run Renovate in ephemeral, isolated runners with no persistent secrets beyond the current job.

Patch Information

The fix is delivered in Renovate 40.33.0 via commit d29698e0131231652970f02765312769975e4d38. Details are published in the Renovate GHSA-xjr7-3c3g-m763 advisory and the VulnCheck advisory.

Workarounds

Disable the gleam manager in Renovate configuration until the upgrade is applied.
Enforce dependency name validation via repository policy or pre-receive hooks to reject gleam.toml entries with shell metacharacters.
Execute Renovate inside a sandboxed container with a read-only filesystem, no outbound network access, and no mounted host credentials.

bash

# Disable the gleam manager in renovate.json until patched
{
  "enabledManagers": [
    "npm",
    "dockerfile",
    "github-actions"
  ],
  "gleam": {
    "enabled": false
  }
}