CVE-2026-76228: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in renovatebot renovate

Renovate versions >=32.124.0 and <42.68.5, and Mend renovate-ce/renovate-ee versions <13.3.0, contain an OS command injection vulnerability in the Gradle Wrapper update process. Renovate invokes the Gradle Wrapper update command via a shell, and if the gradle-wrapper.properties file's distributionUrl includes shell command substitution syntax (e.g., $(...)), the shell executes these commands before Gradle parses the URL. This leads to arbitrary command execution within the Renovate runtime environment. The vulnerability requires an attacker to supply a malicious gradle-wrapper.properties file in a repository Renovate scans. Notably, the issue occurs even when the allowScripts configuration is disabled, increasing the risk of exploitation.

Successful exploitation allows an attacker to execute arbitrary commands on the system running Renovate with the privileges of the Renovate process. This can lead to compromise of the Renovate runtime environment, potentially affecting the integrity and security of the CI/CD pipeline or development environment where Renovate operates. The vulnerability requires local repository manipulation by the attacker but does not require user interaction or elevated privileges beyond Renovate's own.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid scanning repositories that may contain untrusted or malicious gradle-wrapper.properties files. Monitor vendor channels for updates and apply patches promptly once released.