GHSA-2RX9-3G3H-C2JV pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

Summary A crafted lockfile alias could reach several install-time filesystem joins. With --trust-lockfile or a frozen lockfile, traversal segments could create links outside the intended project or nodemodules boundary. This patch validates dependency names and every virtual-store slot before...

CVE-2026-76231

A flaw was found in Renovate. Attackers with repository write access can exploit a command injection vulnerability in the hermit manager. This occurs because user-provided dependency names are not properly sanitized when appended to install and uninstall commands. Successful exploitation allows a...

CVE-2026-76231

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...

CVE-2026-76231 Renovate 32.135.0 before 40.33.0 Command Injection via hermit

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...

EUVD-2026-62472

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...

CVE-2026-76231

Affected: Renovate bot versions 32.135.0 to before 40.33.0. Root cause: The hermit manager appends user-supplied dependency names to shell install/uninstall commands without sanitization. Impact: Attackers with repository write access can inject malicious dependency names to execute arbitrary com...