CVE-2026-76233 is a command injection vulnerability affecting renovatebot's Renovate tool in versions from 39.53.0 up to but not including 40.33.0. The flaw exists in the gleam manager component where the depName parameter is appended to gleam deps update commands without proper sanitization. An attacker with repository write access can craft malicious gleam.toml files that exploit this vulnerability to execute arbitrary commands on the host system running Renovate.

Successful exploitation allows an attacker with repository write permissions to execute arbitrary commands on the Renovate host machine, potentially leading to full system compromise or unauthorized actions at the privilege level of the Renovate process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict repository write access to trusted users only and monitor Renovate usage closely for suspicious activity related to gleam.toml files.