CVE-2026-76229 is a command injection vulnerability affecting renovatebot's renovate product in versions from 39.218.0 before 40.33.0. The vulnerability arises because user-supplied chart names are appended to helm pull commands without proper sanitization in the kustomize manager. An attacker with repository write permissions can exploit this by creating malicious kustomization.yaml files containing crafted chart names, leading to arbitrary command execution on the host running Renovate.

Successful exploitation allows an attacker with repository write access to execute arbitrary commands on the Renovate host machine. This can lead to compromise of the host environment, potentially affecting confidentiality, integrity, and availability of the system and data processed by Renovate.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict repository write access to trusted users only and monitor for suspicious activity related to kustomization.yaml files. Avoid running Renovate with elevated privileges where possible.