CVE-2026-76230 is a command injection vulnerability affecting renovatebot's Renovate product in versions starting at 35.63.0 up to but not including 40.33.0. The vulnerability occurs in the npm manager component where user-controlled packageName inputs are concatenated directly into npm install commands without adequate sanitization. An attacker who has write access to the repository can exploit this by creating malicious Renovate configuration files, leading to arbitrary command execution on the machine running Renovate. The CVSS 4.0 vector indicates local attack vector with low attack complexity, requiring high privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with repository write access to execute arbitrary commands on the Renovate host system. This can lead to full compromise of the Renovate environment, potentially affecting the integrity and availability of the system and any connected resources. The vulnerability does not appear to be exploitable remotely without local or privileged access.

No official patch or remediation guidance is currently available. Users should monitor the vendor's advisory for updates and consider restricting repository write access to trusted users only. Avoid running Renovate with unnecessary privileges until a fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.