CVE-2026-76227
1 advisory.
npm/renovate CVE-2026-76227: medium 5.5, EPSS 0.15%
Child processes spawned by Renovate incorrectly have full access to environment variables
Action: Upgrade renovate to 42.96.3 or later.
npm i renovate@42.96.3npm i renovate@43.4.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 42.68.1 | 42.96.3 | - |
| 43.0.0 | 43.4.4 | - |
Fixed versions
| 42.96.3 | 43.4.4 |
Sources
- osv: GHSA-8wc6-vgrq-x6cf
- https://github.com/renovatebot/renovate/security/advisories/GHSA-8wc6-vgrq-x6cf
- https://github.com/renovatebot/renovate
- https://github.com/renovatebot/renovate/releases/tag/42.96.3
- https://github.com/renovatebot/renovate/releases/tag/43.4.4
CVE-2026-76227 · published · modified · JSON