CVE-2026-76228 in renovate
Summary
by MITRE • 08/19/2026
Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url <value>). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified as CVE-2024-37891 represents a critical command injection flaw within the dependency management tool Renovate, specifically affecting versions greater than or equal to 32.124.0 and prior to 42.68.5 for open-source editions, as well as Mend renovate-ce and renovate-ee versions before 13.3.0. This security defect resides in the handling of Gradle Wrapper artifacts during automated update processes. The core technical flaw stems from how Renovate constructs and executes shell commands when updating the Gradle wrapper distribution URL. Instead of passing arguments directly to an executable binary, which would prevent interpretation by a command interpreter, Renovate invokes the gradlew script through a system shell using syntax such as /bin/sh -c followed by the execution command. This architectural decision introduces a significant attack surface because it allows for shell metacharacter expansion and command substitution within any string passed to that shell invocation.
The operational mechanism of this vulnerability relies on the attacker's ability to inject malicious content into a gradle-wrapper.properties file located in a repository monitored by Renovate. Specifically, if an adversary can modify or introduce a properties file where the distributionUrl field contains shell command substitution syntax, such as $(command) or backtick-enclosed commands, these sequences are evaluated by the underlying shell before Gradle attempts to parse and download the URL. For instance, a maliciously crafted URL might appear as https://example.com/$(whoami). When Renovate processes this update request, it passes the entire string into /bin/sh -c ./gradlew :wrapper --gradle-distribution-url <malicious_url>. The shell interprets $(whoami) and executes the command immediately, resulting in arbitrary code execution within the context of the user account running the Renovate process. This exploitation path is particularly dangerous because it does not require elevated privileges beyond those held by the Renovate service itself, which often possess significant access to repository files and network resources.
The impact of this vulnerability extends far beyond simple information disclosure or local privilege escalation if the runtime environment allows for broader system interaction. An attacker with write access to a target repository can achieve remote code execution on the machine hosting the Renovate instance. This could lead to full compromise of the CI/CD pipeline, theft of sensitive credentials stored in environment variables accessible to the process, lateral movement within internal networks, or deployment of malware such as cryptominers or ransomware agents. The severity is exacerbated by the fact that this vulnerability persists even when security features like allowScripts are disabled. This indicates that the flaw is not merely a result of permissive configuration settings but rather an inherent design issue in how shell commands are constructed and executed for Gradle wrapper updates, bypassing typical script execution controls designed to prevent arbitrary code runs from dependency files.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The root cause is the failure to properly sanitize or escape special elements within user-controllable input before incorporating them into a command string executed by a shell. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving Unix Shell commands like sh or bash. The exploitation vector falls under Initial Access via Supply Chain Compromise if the malicious gradle-wrapper.properties is introduced through a compromised upstream dependency or a targeted pull request, leveraging the trust relationship between developers and automated tooling to execute code without direct user interaction beyond the initial repository modification.
Mitigation strategies must prioritize immediate version upgrades as the primary defense vector. Organizations running affected versions of Renovate should upgrade to version 42.68.5 or later for open-source editions, or version 13.3.0 and above for Mend renovate-ce/renovate-ee instances where this specific command injection flaw has been addressed through code changes that likely involve using direct process execution instead of shell invocation, thereby preventing metacharacter interpretation. In environments where immediate patching is not feasible due to operational constraints or testing requirements, temporary mitigations should focus on restricting the scope of repositories Renovate monitors and enforcing strict access controls on repository write permissions to prevent unauthorized parties from introducing malicious gradle-wrapper.properties files. Additionally, implementing network-level egress filtering can limit the impact by preventing the compromised process from communicating with external command-and-control servers or downloading additional payloads following successful exploitation. Continuous monitoring for anomalous shell activity originating from Renovate processes and auditing pull requests that modify build configuration files are also recommended defensive measures to detect potential exploitation attempts in real-time.