Command Injection Vulnerability in Renovate Dependency Update Tool
CVE-2026-88886

8.5HIGH

Key Information:

Vendor

Renovatebot

Status
Renovate
Vendor
CVE Published:
10 September 2026

What is CVE-2026-88886?

Renovate, a tool designed for automating dependency updates, contains a vulnerability in its manager/gradle-wrapper module. If self-hosted deployments allow for unsafe executions with the 'gradleWrapper' command, a malicious repository can manipulate the 'distributionUrl' value within the gradle/wrapper/gradle-wrapper.properties file. This manipulation can lead to the execution of arbitrary commands during Renovate's processing of Gradle Wrapper updates. The vulnerability is mitigated in Renovate version 44.14.7 and users are advised to review their configurations for added security.

Affected Version(s)

renovate 0 < 44.14.7

renovate 0 < 44.14.7

renovate 0 < 44.14.7

References

https://github.com/renovatebot/renovate/security/advisori...
vendor-advisory
https://www.vulncheck.com/advisories/renovate-before-44.1...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

iaohkut-from-NightWolf-Team
.