CVE-2026-88886

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.14.7 Mend Renovate CE/EE distributions versions prior to 15.4.0 mend-renovate-enterprise-edition Helm chart versions prior to 10.4.0

Description The manager/gradle-wrapper module fails to escape the distributionUrl value read from the gradle/wrapper/gradle-wrapper.properties file before calling the Gradle Wrapper CLI. In self-hosted deployments using binarySource=docker and where allowedUnsafeExecutions includes gradleWrapper, a repository containing a crafted distributionUrl (such as one containing shell metacharacters and commands) can lead to arbitrary command execution as the Renovate user during a Gradle Wrapper update.

Recommendations Update Renovate to version 44.14.7 or later. Update Mend Renovate CE/EE distributions to version 15.4.0 or later. Update mend-renovate-enterprise-edition Helm chart to version 10.4.0 or later. As a temporary mitigation, remove gradleWrapper from the allowedUnsafeExecutions configuration.