CVE-2026-76226

MEDIUM 6.3

Renovate 43.65.0 through 43.102.11 Remote Code Execution via lockFileMaintenance

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.

CWE	CWE-78
Vendor	renovatebot
Product	renovate
Published	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for renovatebot renovate

Be the first to know when new medium vulnerabilities affecting renovatebot renovate are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Affected Versions

renovatebot / renovate

43.65.0 < 43.102.11

renovatebot / renovate

43.65.0 < 43.102.11

renovatebot / renovate

43.65.0 < 43.102.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/renovatebot/renovate/security/advisories/GHSA-5vjq-5jmg-39xq vulncheck.com: https://www.vulncheck.com/advisories/renovate-through-remote-code-execution-via-lockfilemaintenance

Credits

gzm0 viceice