CVE-2026-76232 Renovate 31.51.0 before 40.33.0 Command Injection via helmv3

Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to...

CVE-2026-76233 Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute...

CVE-2026-76232 Renovate 31.51.0 before 40.33.0 Command Injection via helmv3

Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to...

CVE-2026-76231

Affected: Renovate bot versions 32.135.0 to before 40.33.0. Root cause: The hermit manager appends user-supplied dependency names to shell install/uninstall commands without sanitization. Impact: Attackers with repository write access can inject malicious dependency names to execute arbitrary com...

CVE-2026-76231 Renovate 32.135.0 before 40.33.0 Command Injection via hermit

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...

CVE-2026-76231 Renovate 32.135.0 before 40.33.0 Command Injection via hermit

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...

CVE-2026-76230

Renovate (renovatebot/renovate) versions 35.63.0 through 40.32.x contain a command injection vulnerability in the npm manager . The root cause is that user-provided packageName values are appended to npm install commands in lib/modules/manager/npm/post-update/npm.ts without being escaped via the ...

CVE-2026-76230 Renovate 35.63.0 before 40.33.0 Command Injection via npm

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

CVE-2026-76230 Renovate 35.63.0 before 40.33.0 Command Injection via npm

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

CVE-2026-76230 Renovate 35.63.0 before 40.33.0 Command Injection via npm

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

CVE-2026-76229

Renovate (dependency update bot) versions from 39.218.9 (March 26, 2025) before 40.33.0 contain an arbitrary command injection in the kustomize manager . The depName argument passed to the helmRepositoryArgs function in lib/modules/manager/kustomize/artifacts.ts is not escaped using shlex.quote b...

CVE-2026-76229 Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76222

GitPython (versions before 3.1.58) fails to sanitize submodule names read from .gitmodules files, enabling path traversal during submodule initialization. An attacker can craft a malicious repository with traversal sequences (e.g., ../) in submodule names, causing GitPython to create attacker-con...

CVE-2026-76219

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the...

brave-browser v1.95.83

Brave Browser This repository is not needed for building the browser and only holds issues, releases and the wiki. The source code and contributions are at https://github.com/brave/brave-core. You can visit our website to get the latest stable release. Resources Issues: Bug reports and feature...

MAL-2026-14288 Malicious code in @wizloft/harness-plugin-repository-files (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8197c156f5877fb7a024a3007bed2da30176f74960e3fa271cac4c4369f2705 dist/index.js of @wizloft/harness-plugin-repository-files ships a small legitimate wizloft-harness repository-files plugin followed at line 209 by a...

CVE-2019-25766: Insertion of Sensitive Information into Log File

Renovate versions = 13.87.0 and = 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens...

CVE-2026-76231: Improper Neutralization of Special Elements used in a Command

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...

PT-2026-78411

Name of the Vulnerable Software and Affected Versions Renovate versions 39.218.0 through 40.32.0 Description The kustomize manager allows arbitrary command injection because user-provided chart names are appended to helm pull commands without proper sanitization. An attacker with repository write...

CVE-2026-76229: Improper Neutralization of Special Elements used in a Command

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...