Threats tagged 'ghsa-mqp7-cg7m-4hhq'

CVE-2026-76228 is a command injection vulnerability in renovatebot's Renovate tool affecting versions >=32.124.0 and <42.68.5, and Mend renovate-ce/renovate-ee versions <13.3.0. The flaw occurs in the handling of Gradle Wrapper artifacts, where a malicious gradle-wrapper.properties file with a crafted distributionUrl can cause arbitrary command execution during Renovate's Gradle Wrapper update process. Exploitation requires an attacker to introduce this malicious file into a repository scanned by Renovate. This vulnerability is rated high severity with a CVSS score of 8.4. No patch links or vendor advisory details are provided, so patch status is not confirmed.