CVE-2026-88886

A flaw was found in Renovate. The manager/gradle-wrapper module does not properly escape the distributionUrl value from a repository's gradle/wrapper/gradle-wrapper.properties file. In self-hosted deployments configured with binarySource=docker and allowedUnsafeExecutions='gradleWrapper', ..., a...

EUVD-2026-75436

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88886

Renovate (a dependency update automation tool) before 44.14.7 is affected by a command injection in the manager/gradle-wrapper module. The distributionUrl value read from a repository's gradle-wrapper.properties file is not escaped before invoking the Gradle Wrapper CLI. In self-hosted deployment...

PT-2026-89397

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88886: Improper Neutralization of Special Elements used in an OS Command

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CLEANSTART-2026-DC01950 Security fixes in gradle 8.14.5-r1

Package gradle version 8.14.5-r1 fixes 3 vulnerabilities: CVE-2026-54512, CVE-2026-54513, ghsa-r7wm-3cxj-wff9...

CLEANSTART-2026-EW26972 Security fixes in gradle 7.6.1-r0

Package gradle version 7.6.1-r0 fixes 1 vulnerabilities: CVE-2023-26053...

CLEANSTART-2026-SS49712 Security fixes in gradle 6.8.3-r0

Package gradle version 6.8.3-r0 fixes 1 vulnerabilities: CVE-2020-11979...

CLEANSTART-2026-AE85889 Security fixes in gradle 7.2-r0

Package gradle version 7.2-r0 fixes 1 vulnerabilities: CVE-2021-32751...

CLEANSTART-2026-HU47571 Security fixes in gradle 9.7.1-r0

Package gradle version 9.7.1-r0 fixes 3 vulnerabilities: CVE-2026-59889, CVE-2026-54515, CVE-2026-71497...

CVE-2026-76228

A flaw was found in Renovate. This command injection vulnerability occurs when Renovate processes Gradle Wrapper updates. An attacker can introduce a malicious gradle-wrapper.properties file into a scanned repository, where a specially crafted distributionUrl containing shell command substitution...

CVE-2026-76228

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

CVE-2026-76228 Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

CVE-2026-76228 Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

EUVD-2026-62469

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

CVE-2026-76228

Renovate versions >=32.124.0 before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) pass attacker-controlled distributionUrl values from gradle-wrapper.properties directly into a shell command (/bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url ), allowing shell command subst...

CVE-2026-76228 Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...