renovatebot Renovate gradle-wrapper distributionUrl os command injection

Summaryinfo

A vulnerability identified as problematic has been detected in renovatebot Renovate. Affected by this vulnerability is an unknown functionality of the component gradle-wrapper. This manipulation of the argument distributionUrl causes os command injection. This vulnerability is handled as CVE-2026-88886. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability has been found in renovatebot Renovate (affected version not known) and classified as problematic. Affected by this vulnerability is some unknown functionality of the component gradle-wrapper. The manipulation of the argument distributionUrl with an unknown input leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0), the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository's gradle/wrapper/gradle-wrapper.properties file before invoking the Gradle Wrapper CLI. In self-hosted deployments configured with binarySource=docker and allowedUnsafeExecutions=['gradleWrapper', ...], a repository that supplies a crafted distributionUrl (for example, appending a shell metacharacter and command) can cause arbitrary commands to be executed as the Renovate user when Renovate processes a Gradle Wrapper update. The issue is fixed in Renovate 44.14.7; as a workaround, remove 'gradleWrapper' from allowedUnsafeExecutions.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-88886 since 09/10/2026. The exploitation appears to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• renovatebot

Name

• Renovate

Website

• Product: https://github.com/renovatebot/renovate/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion