CVE-2026-76228

Name of the Vulnerable Software and Affected Versions Renovate versions 32.124.0 through 42.68.4 Mend renovate-ce/renovate-ee versions prior to 13.3.0

Description Command injection occurs during Gradle Wrapper artifact handling. When processing updates, the software invokes a wrapper update command via a shell. If a malicious gradle-wrapper.properties file is introduced into a scanned repository, an attacker can use shell command substitution syntax within the distributionUrl variable. The shell evaluates this syntax before Gradle parses the URL, allowing arbitrary command execution in the runtime. This issue persists even when allowScripts is disabled.

Recommendations Update Renovate to version 42.68.5 or later. Update Mend renovate-ce/renovate-ee to version 13.3.0 or later.