{"cve":"CVE-2026-76229","nvd":{"published":"2026-08-19T14:17:50.133","modified":"2026-09-08T20:28:37.587","status":"Awaiting Analysis","description":"Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yaml files with specially crafted chart names to execute arbitrary commands on the Renovate host machine.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.4},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":6.7},"cwes":["CWE-77"],"references":["https://github.com/renovatebot/renovate/commit/cc08c6e98f19e6258c5d3180c70c98e1be0b0d37","https://github.com/renovatebot/renovate/security/advisories/GHSA-xv56-3wq5-9997","https://www.vulncheck.com/advisories/renovate-before-arbitrary-command-injection-via-kustomize"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:49:38.260478770+00:00"},"epss":{"cve":"CVE-2026-76229","score":0.01003,"percentile":0.62948,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-xv56-3wq5-9997","url":"https://osv.dev/vulnerability/GHSA-xv56-3wq5-9997","summary":"Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repository","modified":"2026-08-20T04:04:15.976479728Z","packages":[{"ecosystem":"npm","name":"renovate","purl":"pkg:npm/renovate","ranges":[">=39.218.0 <40.33.0"],"fixed":["40.33.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}