CVE-2026-76228 is an OS command injection vulnerability in renovatebot renovate affecting versions >=32.124.0 and <42.68.5, and Mend renovate-ce/renovate-ee before 13.3.0. The vulnerability arises when Renovate processes Gradle Wrapper updates by invoking a shell command to update the wrapper. If an attacker supplies a malicious gradle-wrapper.properties file with a distributionUrl containing shell command substitution syntax (e.g., $(...)), the shell evaluates this before Gradle parses the URL, enabling arbitrary command execution within the Renovate runtime environment. This requires the attacker to introduce the malicious file into a repository scanned by Renovate. The vulnerability is notable because it occurs even when the allowScripts option is disabled, reducing typical mitigations.

Successful exploitation allows an attacker to execute arbitrary commands on the Renovate runtime host with the privileges of the Renovate process. This can lead to compromise of the Renovate environment, potentially enabling further attacks or unauthorized access to resources. The vulnerability requires attacker control over repository content but does not require user interaction or elevated privileges beyond Renovate's own execution context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid scanning repositories with untrusted Gradle Wrapper files or disable Gradle Wrapper updates if possible. Monitor vendor channels for updates and apply official patches once released.