Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url <value>). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled.
{
"cwe_ids": [
"CWE-78"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76228.json"
}{
"extracted_events": [
{
"introduced": "32.124.0"
},
{
"fixed": "42.68.5"
},
{
"introduced": "0"
},
{
"fixed": "13.3.0"
}
],
"source": "AFFECTED_FIELD"
}