CVE-2026-76226 in Renovate
Summary
by MITRE • 08/19/2026
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The identified security flaw resides within the Renovate automation tool, specifically affecting versions ranging from 43.65.0 up to but not including 43.102.11. This vulnerability is classified as a remote code execution issue that impacts the bazel-module and bazelisk managers when they are configured with lockFileMaintenance enabled. The core of the problem lies in how Renovate processes dependency updates for Bazel-based projects, where it interacts with external repositories to fetch module definitions and resolve dependencies. Under normal circumstances, this process is designed to be safe by validating inputs against known good states or using strict parsing rules. However, a flaw in the implementation allows an attacker who controls or influences the content of referenced bazel modules to inject malicious code that gets executed during the maintenance cycle.
The technical mechanism behind this exploitation involves the way Renovate handles dependency resolution for Bazel modules. When lockFileMaintenance is active, Renovate periodically updates the lock file to reflect the latest available versions of dependencies. During this process, it may invoke bazel commands or scripts provided by the module definitions themselves. Specifically, if a malicious actor publishes a bazel module that includes crafted deps entries pointing to resources containing executable payloads within ctx.execute statements, these instructions can be triggered inadvertently. The vulnerability arises because Renovate does not sufficiently sanitize or sandbox the execution context of these external dependencies before allowing them to interact with the host system's environment variables and command shells. This lack of isolation permits arbitrary code execution on the machine running the Renovate process.
From an operational perspective, this vulnerability poses a severe risk to organizations relying on automated dependency management for their Bazel projects. Since Renovate is often integrated into continuous integration pipelines or run as a scheduled service with elevated privileges to manage repository configurations, successful exploitation could lead to full system compromise. An attacker does not need direct access to the target infrastructure; instead, they can exploit this by publishing malicious packages to public registries that are then pulled in during routine maintenance updates. This creates a supply chain attack vector where trust in third-party dependencies is abused to gain initial foothold within an organization's development or build environment. The impact extends beyond simple code execution, potentially leading to data exfiltration, lateral movement across internal networks, and persistent backdoors if the compromised system has access to sensitive artifacts or credentials stored in the CI/CD pipeline.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), as it involves the injection of malicious code through untrusted input sources that are subsequently executed by a privileged process. It also maps to MITRE ATT&CK techniques related to Supply Chain Compromise and Command and Scripting Interpreter abuse, highlighting how attackers can leverage trusted tools like Renovate to bypass security controls. To mitigate this risk, organizations should immediately upgrade Renovate to version 43.102.11 or later, where the issue has been addressed through improved input validation and stricter sandboxing of dependency execution contexts. Additionally, teams should review their bazel-module configurations to ensure that only verified and trusted dependencies are included in lock files. Implementing strict allow-lists for external repositories and monitoring logs for unusual command executions during maintenance cycles can further reduce exposure until the patch is fully deployed across all affected environments.