{"id":"CVE-2026-76233","summary":"Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager","details":"Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate.","aliases":["GHSA-xjr7-3c3g-m763"],"modified":"2026-08-21T03:47:08.631807961Z","published":"2026-08-19T14:02:13.767Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-77"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76233.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76233.json"},{"type":"ADVISORY","url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-xjr7-3c3g-m763"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76233"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/renovate-before-command-injection-via-gleam-manager"},{"type":"FIX","url":"https://github.com/renovatebot/renovate/commit/d29698e0131231652970f02765312769975e4d38"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/renovatebot/renovate","events":[{"introduced":"acf6d8d9c11251976fe982db97b5db464f1be0f2"},{"fixed":"c3a6a73c7970414e8f65741b4e207f532d898a48"},{"fixed":"d29698e0131231652970f02765312769975e4d38"}],"database_specific":{"extracted_events":[{"introduced":"39.53.0"},{"fixed":"40.33.0"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["40.32.7","40.32.6","40.32.5","40.32.4","40.32.3","40.32.2","40.32.1","40.32.0","40.31.1","40.31.0","40.30.2","39.264.0","40.30.1","40.30.0","40.29.1","40.29.0","40.28.0","40.27.1","40.27.0","40.26.3","40.26.2","40.26.1","40.26.0","40.25.2","40.25.1","40.25.0","40.24.3","40.24.2","40.24.1","40.24.0","40.23.2","40.23.1","40.23.0","40.22.1","40.22.0","40.21.7","40.21.6","40.21.5","40.21.4","40.21.3","40.21.2","40.21.1","40.21.0","40.20.0","40.19.2","40.19.1","40.19.0","40.18.3","40.18.2","40.18.1","40.18.0","40.17.1","40.17.0","40.16.0","40.15.0","40.14.6","40.14.5","40.14.4","39.238.2","40.14.3","40.14.2","40.14.1","40.14.0","40.13.1","40.13.0","40.12.4","40.12.3","40.12.2","40.12.1","40.12.0","40.11.19","40.11.18","40.11.17","40.11.16","40.11.15","40.11.14","40.11.13","40.11.12","40.11.11","40.11.10","40.11.9","40.11.8","40.11.7","40.11.6","40.11.5","40.11.4","40.11.3","40.11.2","40.11.1","40.11.0","40.10.7","40.10.6","40.10.5","40.10.4","40.10.3","40.10.2","40.10.1","40.10.0","40.9.1","40.9.0","40.8.2","40.8.1","40.8.0","40.7.1","40.7.0","40.6.0","40.5.1","40.5.0","40.4.0","40.3.6","40.3.5","40.3.4","40.3.3","40.3.2","40.3.1","40.3.0","40.2.0","40.1.4","40.1.3","40.1.2","40.1.1","40.1.0","40.0.9","40.0.8","40.0.7","40.0.6","40.0.5","40.0.4","40.0.3","40.0.2","40.0.1","40.0.0","39.263.1","39.263.0","39.262.1","39.262.0","39.261.4","39.261.3","39.261.2","39.261.1","39.261.0","39.260.0","39.259.0","39.258.3","39.258.2","39.258.1","39.258.0","39.257.8","39.257.7","39.257.6","39.257.5","39.257.4","39.257.3","39.257.2","39.257.1","39.257.0","39.256.1","39.256.0","39.255.0","39.254.3","39.254.2","39.254.1","39.254.0","39.253.5","39.253.4","39.253.3","39.253.2","39.253.1","39.253.0","39.252.0","39.251.3","39.251.2","39.251.1","39.251.0","39.250.3","39.250.2","39.250.1","39.250.0","39.249.0","39.248.4","39.248.3","39.248.2","39.248.1","39.248.0","39.247.0","39.246.1","39.246.0","39.245.3","39.245.2","39.245.1","39.245.0","39.244.3","39.244.2","39.244.1","39.244.0","39.243.0","39.242.2","39.242.1","39.242.0","39.241.2","39.241.1","39.241.0","39.240.1","39.240.0","39.239.0","39.238.1","39.238.0","39.237.0","39.236.2","39.236.1","39.236.0","39.235.4","39.235.3","39.235.2","39.235.1","39.235.0","39.234.0","39.233.6","39.233.5","39.233.4","39.233.3","39.233.2","39.233.1","39.233.0","39.232.4","39.232.3","39.232.2","39.232.1","39.232.0","39.231.0","39.230.3","39.230.2","39.230.1","39.230.0","39.229.0","39.228.1","39.228.0","39.227.3","39.227.2","39.227.1","39.227.0","39.226.0","39.225.0","39.224.0","39.223.0","39.222.4","39.222.3","39.222.2","39.222.1","39.222.0","39.221.0","39.220.7","39.220.6","39.220.5","39.220.4","39.220.3","39.220.2","39.220.1","39.220.0","39.219.3","39.219.2","39.219.1","39.219.0","39.218.1","39.218.0","39.217.0","39.216.1","39.216.0","39.215.2","39.215.1","39.215.0","39.214.0","39.213.6","39.213.5","39.213.4","39.213.3","39.213.2","39.213.1","39.213.0","39.212.2","39.212.1","39.212.0","39.211.4","39.211.3","39.211.2","39.211.1","39.211.0","39.210.1","39.210.0","39.209.0","39.208.1","39.208.0","39.207.3","39.207.2","39.207.1","39.207.0","39.206.0","39.205.2","39.205.1","39.205.0","39.204.0","39.203.1","39.203.0","39.202.0","39.201.0","39.200.4","39.200.3","39.200.2","39.200.1","39.200.0","39.199.1","39.199.0","39.198.1","39.198.0","39.197.0","39.196.0","39.195.1","39.195.0","39.194.1","39.194.0","39.193.5","39.193.4","39.193.3","39.193.2","39.193.1","39.193.0","39.192.0","39.191.4","39.191.3","39.191.2","39.191.1","39.191.0","39.190.1","39.190.0","39.189.0","39.188.4","39.188.3","39.188.2","39.188.1","39.188.0","39.187.0","39.186.1","39.186.0","39.185.9","39.185.8","39.185.7","39.185.6","39.185.5","39.185.4","39.185.3","39.185.2","39.185.1","39.185.0","39.184.0","39.183.0","39.182.5","39.182.4","39.182.3","39.182.2","39.182.1","39.182.0","39.181.1","39.181.0","39.180.3","39.180.2","39.180.1","39.180.0","39.179.1","39.179.0","39.178.3","39.178.2","39.178.1","39.178.0","39.177.3","39.177.2","39.177.1","39.177.0","39.176.4","39.176.3","39.176.2","39.176.1","39.176.0","39.175.8","39.175.7","39.175.6","39.175.5","39.175.4","39.175.3","39.175.2","39.175.1","39.175.0","39.174.3","39.174.2","39.174.1","39.174.0","39.173.1","39.173.0","39.172.1","39.172.0","39.171.3","39.171.2","39.171.1","39.171.0","39.170.3","39.170.2","39.170.1","39.170.0","39.169.3","39.169.2","39.169.1","39.169.0","39.168.1","39.168.0","39.167.1","39.167.0","39.166.1","39.166.0","39.165.3","39.165.2","39.165.1","39.165.0","39.164.1","39.164.0","39.163.0","39.162.3","39.162.2","39.162.1","39.162.0","39.161.6","39.161.5","39.161.4","39.161.3","39.161.2","39.161.1","39.161.0","39.160.1","39.160.0","39.159.0","39.158.2","39.158.1","39.158.0","39.157.0","39.156.2","39.156.1","39.156.0","39.155.0","39.154.0","39.153.2","39.153.1","39.153.0","39.152.0","39.151.0","39.150.0","39.149.0","39.148.0","39.147.0","39.146.4","39.146.3","39.146.2","39.146.1","39.146.0","39.145.1","39.145.0","39.144.4","39.144.3","39.144.2","39.144.1","39.144.0","39.143.0","39.142.0","39.141.0","39.140.3","39.140.2","39.140.1","39.140.0","39.139.0","39.138.2","39.138.1","39.138.0","39.137.2","39.137.1","39.137.0","39.136.2","39.136.1","39.136.0","39.135.3","39.135.2","39.135.1","39.135.0","39.134.0","39.133.4","39.133.3","39.133.2","39.133.1","39.133.0","39.132.1","39.132.0","39.131.0","39.130.0","39.129.0","39.128.0","39.127.0","39.126.1","39.126.0","39.125.1","39.125.0","39.124.0","39.123.0","39.122.3","39.122.2","39.122.1","39.122.0","39.121.0","39.120.4","39.120.3","39.120.2","39.120.1","39.120.0","39.119.2","39.119.1","39.119.0","39.118.5","39.118.4","39.118.3","39.118.2","39.118.1","39.118.0","39.117.3","39.117.2","39.117.1","39.117.0","39.116.1","39.116.0","39.115.4","39.115.3","39.115.2","39.115.1","39.115.0","39.114.0","39.113.0","39.112.0","39.111.1","39.111.0","39.110.0","39.109.0","39.108.0","39.107.3","39.107.2","39.107.1","39.107.0","39.106.1","39.106.0","39.105.1","39.105.0","39.104.3","39.104.2","39.104.1","39.104.0","39.103.0","39.102.0","39.101.0","39.100.2","39.100.1","39.100.0","39.99.0","39.98.0","39.97.0","39.96.2","39.96.1","39.96.0","39.95.0","39.94.2","39.94.1","39.94.0","39.93.1","39.93.0","39.92.2","39.92.1","39.92.0","39.91.4","39.91.3","39.91.2","39.91.1","39.91.0","39.90.5","39.90.4","39.90.3","39.90.2","39.90.1","39.90.0","39.89.0","39.88.1","39.88.0","39.87.0","39.86.5","39.86.4","39.86.3","39.86.2","39.86.1","39.86.0","39.85.0","39.84.1","39.84.0","39.83.6","39.83.5","39.83.4","39.83.3","39.83.2","39.83.1","39.83.0","39.82.9","39.82.8","39.82.7","39.82.6","39.82.5","39.82.4","39.82.3","39.82.2","39.82.1","39.82.0","39.81.0","39.80.0","39.79.1","39.79.0","39.78.0","39.77.0","39.76.0","39.75.1","39.75.0","39.74.1","39.74.0","39.73.0","39.72.5","39.72.4","39.72.3","39.72.2","39.72.1","39.72.0","39.71.0","39.70.0","39.69.4","39.69.3","39.69.2","39.69.1","39.69.0","39.68.1","39.68.0","39.67.0","39.66.0","39.65.2","39.65.1","39.65.0","39.64.0","39.63.1","39.63.0","39.62.6","39.62.5","39.62.4","39.62.3","39.62.2","39.62.1","39.62.0","39.61.1","39.61.0","39.60.0","39.59.0","39.58.1","39.58.0","39.57.4","39.57.3","39.57.2","39.57.1","39.57.0","39.56.4","39.56.3","39.56.2","39.56.1","39.56.0","39.55.0","39.54.0","39.53.1","39.53.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76233.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}