RenovateBot Renovate up to 40.32.x Helmv3 Manager Chart.yaml repository command injection

Summaryinfo

A vulnerability classified as problematic was found in RenovateBot Renovate up to 40.32.x. This affects an unknown part of the file Chart.yaml of the component Helmv3 Manager. The manipulation of the argument repository results in command injection. This vulnerability is known as CVE-2026-76232. Attacking locally is a requirement. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in RenovateBot Renovate up to 40.32.x. Affected is an unknown function of the file Chart.yaml of the component Helmv3 Manager. The manipulation of the argument repository with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to execute arbitrary commands on the machine running Renovate.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-76232 since 08/19/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading to version 40.33.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• RenovateBot

Name

• Renovate

Version

• 40.0
• 40.1
• 40.2
• 40.3
• 40.4
• 40.5
• 40.6
• 40.7
• 40.8
• 40.9
• 40.10
• 40.11
• 40.12
• 40.13
• 40.14
• 40.15
• 40.16
• 40.17
• 40.18
• 40.19
• 40.20
• 40.21
• 40.22
• 40.23
• 40.24
• 40.25
• 40.26
• 40.27
• 40.28
• 40.29
• 40.30
• 40.31
• 40.32

Website

• Product: https://github.com/renovatebot/renovate/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion