Command Injection Vulnerability in Renovate by Mend

CVE-2026-76228

What is CVE-2026-76228?

A command injection vulnerability exists in Renovate, specifically in how it handles Gradle Wrapper artifact updates. This vulnerability allows an attacker to execute arbitrary commands on the Renovate runtime if they can introduce a malicious gradle-wrapper.properties file into a repository that Renovate scans. The vulnerability is triggered when Renovate processes Gradle Wrapper updates and invokes a shell command with the provided distribution URL. Even with the allowScripts option disabled, if the distribution URL contains shell command substitution syntax, it can be evaluated by the shell before Gradle processes the URL, leading to remote code execution.

References