{"id":"EUVD-2026-62469","enisaUuid":"d79e1287-4fc5-3d8c-8956-ea2af2bb7073","description":"Renovate versions \u003e\u003d32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url \u003cvalue\u003e). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled.","datePublished":"Aug 19, 2026, 2:02:10 PM","dateUpdated":"Oct 8, 2026, 3:25:04 PM","baseScore":8.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96\nhttps://www.vulncheck.com/advisories/renovate-before-remote-code-execution-via-gradle-wrapper\n","aliases":"CVE-2026-76228\nGHSA-mqp7-cg7m-4hhq\n","assigner":"VulnCheck","epss":0.96,"enisaIdProduct":[{"id":"36cb9aad-67cc-3526-a14b-8e260a2c9841","product":{"name":"renovate-ee-worker","vendor":{"name":"mend"}},"product_version":"0 \u003c13.3.0"},{"id":"672f4f1a-29a6-37d2-86e8-32c32895f01e","product":{"name":"renovate","vendor":{"name":"renovatebot"}},"product_version":"32.124.0 \u003c42.68.5"},{"id":"c7dbedef-7399-30ec-b124-3126e5fc8a35","product":{"name":"renovate-ce","vendor":{"name":"mend"}},"product_version":"0 \u003c13.3.0"},{"id":"ca12bb43-8de9-32f8-8ca3-20dbd9272770","product":{"name":"renovate-ee-server","vendor":{"name":"mend"}},"product_version":"0 \u003c13.3.0"}],"enisaIdVendor":[{"id":"0e723dea-b8bc-3909-a996-a5af2a07b00a","vendor":{"name":"renovatebot"}},{"id":"e17586f4-1780-3957-b948-cc86c9163c9e","vendor":{"name":"mend"}}],"enisaIdVulnerability":[{"id":"7364d429-a365-35b9-9db2-2f1787663821","vulnerability":{"id":"GHSA-mqp7-cg7m-4hhq","description":"Renovate versions \u003e\u003d32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url \u003cvalue\u003e). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled.","datePublished":"Aug 19, 2026, 3:32:34 PM","dateUpdated":"Aug 19, 2026, 3:32:34 PM","baseScore":0.0,"references":"https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76228\nhttps://www.vulncheck.com/advisories/renovate-before-remote-code-execution-via-gradle-wrapper\n","enisa_id":"EUVD-2026-62469\n","aliases":"GHSA-mqp7-cg7m-4hhq\nCVE-2026-76228\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:59:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"75ef58aa-7bf5-3ff3-9d70-48671b14a5e1","vulnerability":{"id":"CVE-2026-76228","description":"Renovate versions \u003e\u003d32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url \u003cvalue\u003e). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled.","datePublished":"Aug 19, 2026, 2:02:10 PM","dateUpdated":"Oct 8, 2026, 3:25:04 PM","status":"PUBLISHED","baseScore":8.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96\nhttps://www.vulncheck.com/advisories/renovate-before-remote-code-execution-via-gradle-wrapper\n","enisa_id":"EUVD-2026-62469\n","assigner":"VulnCheck","epss":0.96,"dataProcessed":"Oct 30, 2026, 7:14:51 AM","vulnerabilityProduct":[{"id":"416db03f-053e-39d4-ade3-8444037c6721","product":{"name":"renovate-ce","vendor":{"name":"mend"}},"product_version":"0 \u003c13.3.0"},{"id":"425e3ee2-6aa2-35f7-8a0d-d297860df9d1","product":{"name":"renovate-ee-worker","vendor":{"name":"mend"}},"product_version":"0 \u003c13.3.0"},{"id":"90c8a7cd-d79f-396d-9922-2ac7294f5f33","product":{"name":"renovate","vendor":{"name":"renovatebot"}},"product_version":"32.124.0 \u003c42.68.5"},{"id":"aab53fd4-9b67-366a-a9a0-8edb05d3508c","product":{"name":"renovate-ee-server","vendor":{"name":"mend"}},"product_version":"0 \u003c13.3.0"}],"vulnerabilityVendor":[{"id":"1b8e7e09-2f4f-349f-9db6-378fdc5efd20","vendor":{"name":"mend"}},{"id":"d9efb782-c9b7-3741-b425-347a828b49c1","vendor":{"name":"renovatebot"}}]}}],"enisaIdAdvisory":[]}