RenovateBot Renovate up to 40.32.x Gleam Manager gleam.toml depName command injection

Summaryinfo

A vulnerability was found in RenovateBot Renovate up to 40.32.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the file gleam.toml of the component Gleam Manager. Performing a manipulation of the argument depName results in command injection. This vulnerability is identified as CVE-2026-76233. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in RenovateBot Renovate up to 40.32.x. This affects an unknown function of the file gleam.toml of the component Gleam Manager. The manipulation of the argument depName with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-76233 since 08/19/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation needs additional levels of successful authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

Upgrading to version 40.33.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• RenovateBot

Name

• Renovate

Version

• 40.0
• 40.1
• 40.2
• 40.3
• 40.4
• 40.5
• 40.6
• 40.7
• 40.8
• 40.9
• 40.10
• 40.11
• 40.12
• 40.13
• 40.14
• 40.15
• 40.16
• 40.17
• 40.18
• 40.19
• 40.20
• 40.21
• 40.22
• 40.23
• 40.24
• 40.25
• 40.26
• 40.27
• 40.28
• 40.29
• 40.30
• 40.31
• 40.32

Website

• Product: https://github.com/renovatebot/renovate/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion