{"action":"Upgrade renovate to 42.68.5 or later.","affected":[{"fixed":"42.68.5","introduced":"32.124.0"}],"component":"renovate","cve_ids":["CVE-2026-76228"],"ecosystem":"npm","epss":0.00959,"exploited":false,"fixed_versions":["42.68.5"],"ghsa_id":"GHSA-pfq2-hh62-7m96","id":"tcs_01M5KG3FNSZS8KVGT444J23060","modified_at":"2026-08-20T04:04:14.407726185Z","published_at":"2026-01-13T19:54:29Z","references":["https://osv.dev/vulnerability/GHSA-pfq2-hh62-7m96","https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96","https://github.com/renovatebot/renovate","https://github.com/renovatebot/renovate/releases/tag/42.68.5"],"severity":{"label":"medium","score":6.7},"sources":[{"source":"osv","source_id":"GHSA-pfq2-hh62-7m96","url":"https://osv.dev/vulnerability/GHSA-pfq2-hh62-7m96"}],"summary":"Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`"}