Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance
Priority LOW 30CWE-78Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00294 22nd percentileScored 2026-11-07
Fix Fixed renovate (renovatebot): 43.102.11
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| renovatebot | renovate | 43.65.0 to before 43.102.11 | 43.102.11 | Patch available | CNA |
- renovate Vendorrenovatebot Affected 43.65.0 to before 43.102.11 Fixed in 43.102.11 Patch available CNA
Remediation
- Fix · CNA renovate (renovatebot) Fixed in 43.102.11
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-76226
- 2026-10-03 Alias added: GHSA-7g3f-prg4-fg23
References
More renovatebot vulnerabilities
- TI-2026-53338 Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager CVSS 4.0HIGH 8.4
- TI-2026-53337 Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 CVSS 4.0HIGH 8.4
- TI-2026-53336 Renovate 32.135.0 before 40.33.0 Command Injection via hermit CVSS 4.0HIGH 8.4
- TI-2026-53335 Renovate 35.63.0 before 40.33.0 Command Injection via npm CVSS 4.0HIGH 8.4
- TI-2026-53333 Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper CVSS 4.0HIGH 8.4
- TI-2026-60271 Renovate before 44.11.2 Credential Exfiltration via Link Header CVSS 4.0CRITICAL 9.2
Sources
- CVE-2026-76226 · CVE Program
- CVE-2026-76226 · NVD
- FIRST EPSS
- GHSA-7g3f-prg4-fg23 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-76226 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences