CVE-2026-76228
1 advisory.
npm/renovate CVE-2026-76228: medium 6.7, EPSS 0.96%
Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`
Action: Upgrade renovate to 42.68.5 or later.
npm i renovate@42.68.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 32.124.0 | 42.68.5 | - |
Fixed versions
| 42.68.5 |
Sources
- osv: GHSA-pfq2-hh62-7m96
- https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96
- https://github.com/renovatebot/renovate
- https://github.com/renovatebot/renovate/releases/tag/42.68.5
CVE-2026-76228 · published · modified · JSON