CVE-2026-76233

EUVD-2026-62474
Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.7 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/renovatebot/renovate/commit/d29698e0131231652970f02765312769975e4d38
https://github.com/renovatebot/renovate/security/advisories/GHSA-xjr7-3c3g-m763
https://www.vulncheck.com/advisories/renovate-before-command-injection-via-gleam-manager
https://github.com/renovatebot/renovate/security/advisories/GHSA-xjr7-3c3g-m763