CVE-2026-76232 is a command injection vulnerability affecting renovatebot's Renovate product in versions starting from 31.51.0 up to but not including 40.33.0. The flaw exists in the helmv3 manager where the repository parameter is improperly neutralized when appended to helm registry login commands. This allows attackers who have write access to the repository to inject and execute arbitrary commands on the host system running Renovate by manipulating Chart.yaml files.

Successful exploitation allows an attacker with repository write permissions to execute arbitrary commands on the Renovate host system, potentially leading to full system compromise or unauthorized actions with the privileges of the Renovate process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict repository write access to trusted users only and monitor for suspicious activity related to helm commands within Renovate.