CVE-2026-76231 is a command injection vulnerability in renovatebot's renovate product affecting versions from 32.135.0 up to but not including 40.33.0. The flaw exists in the hermit manager component where user-supplied dependency names are concatenated directly into shell commands for installation and uninstallation without adequate sanitization or neutralization of special characters. This allows an attacker with repository write permissions to craft malicious dependency names that execute arbitrary commands on the host system running Renovate.

Successful exploitation allows an attacker with repository write access to execute arbitrary commands on the Renovate host machine, potentially leading to system compromise or unauthorized actions. The vulnerability has a high severity CVSS score of 8.4, reflecting the significant risk posed by command injection in this context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict repository write access to trusted users only to reduce the risk of exploitation.