CVE-2026-76231: Improper Neutralization of Special Elements used in a Command ('Command Injection') in renovatebot renovate

CVE-2026-76231 is a command injection vulnerability affecting renovatebot's renovate tool in versions >=32.135.0 and <40.33.0. The vulnerability exists in the hermit manager component where user input, specifically dependency names, is improperly sanitized before being appended to install and uninstall commands. This allows an attacker with repository write access to execute arbitrary commands on the system where renovate runs. The CVSS 4.0 vector indicates local attack vector with low complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with repository write access can exploit this vulnerability to execute arbitrary commands on the system running renovate, potentially leading to full compromise of the environment where renovate operates. This can affect confidentiality, integrity, and availability of the system and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict repository write access to trusted users only and monitor for suspicious activity related to dependency names. Avoid running renovate with elevated privileges if possible.