Command Injection

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Command Injection in the manager/gradle-wrapper process. An attacker can execute arbitrary commands as the Renovate user by supplying a crafted distributionUrl value in the gradle-wrapper.properties fil...

CVE-2026-76228: Improper Neutralization of Special Elements used in an OS Command

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...