PT-2026-78408

CVE-2026-76226

Published

2026-04-16

Updated

2026-10-24

Description by

CVSS 4.0

6.8

Medium

MetricsAV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Renovate versions 43.65.0 through 43.102.10

Description A remote code execution issue exists in the bazel-module and bazelisk managers when the lockFileMaintenance feature is enabled. An attacker can execute arbitrary code by supplying malicious dependencies that are subsequently referenced in bazel mod deps calls, specifically within ctx.execute statements.

Recommendations Update Renovate to version 43.102.11 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers