Command Injection Vulnerability in Renovate by RenovateBot

CVE-2026-76232

What is CVE-2026-76232?

Renovate versions between 31.51.0 and 40.33.0 have a command injection flaw in the helmv3 manager. The vulnerability arises when the repository parameter in the helm registry login commands is appended without adequate sanitization, allowing attackers with repository write access to inject malicious Chart.yaml files. This exploitation could lead to arbitrary command execution on servers running Renovate, posing significant risks to the integrity and security of the system.

References