{"id":"CVE-2026-76226","aliases":["EUVD-2026-62467","GHSA-5vjq-5jmg-39xq","GHSA-7g3f-prg4-fg23"],"status":"published","title":"Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance","description":"Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.","severity":{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00294,"percentile":0.22229,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78","CWE-94"],"published":"2026-04-16T01:34:39Z","modified":"2026-10-28T02:30:22Z","fixes":[{"ecosystem":"npm","package":"renovate","fixed_in":["43.102.11"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"renovate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"43.65.0"},{"fixed":"43.102.11"}]}]},{"source":"osv","ecosystem":"npm","package":"renovate","ranges":[{"type":"SEMVER","events":[{"introduced":"43.65.0"},{"fixed":"43.102.11"}]}]}],"products":[{"vendor":"renovatebot","product":"renovate"}],"references":[{"url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-5vjq-5jmg-39xq","tags":["vendor-advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/renovate-through-remote-code-execution-via-lockfilemaintenance","tags":["third-party-advisory","advisory"]},{"url":"https://github.com/renovatebot/renovate/releases/tag/43.102.11","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5vjq-5jmg-39xq"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76226","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7g3f-prg4-fg23"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76226.json","tags":["advisory"]},{"url":"https://github.com/renovatebot/renovate","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-76226","title":"Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance","description":"Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.","status":"published","published":"2026-08-19T14:02:08.689Z","modified":"2026-10-08T15:25:03.45Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:46:21.568011Z"}],"euvd":[{"id":"EUVD-2026-62467","description":"Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.","status":"published","published":"2026-08-19T14:02:08Z","modified":"2026-10-08T15:25:03Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:31.218078Z"}],"ghsa":[{"id":"GHSA-5vjq-5jmg-39xq","title":"Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance","description":"When using [`lockFileMaintenance`](https://docs.renovatebot.com/configuration-options/#lockfilemaintenance) using the [bazel-module](https://docs.renovatebot.com/modules/manager/bazel-module/) or [bazelisk](https://docs.renovatebot.com/modules/manager/bazelisk/) managers between Renovate [43.65.0](https://github.com/renovatebot/renovate/releases/tag/43.65.0) (2026-03-12) and [43.102.11](https://github.com/renovatebot/renovate/releases/tag/43.102.11) (2026-04-02), there was the opportunity for remote code execution from a malicious dependency, _if the Bazel module executes code that relies on a dependency_.\n\nAs this is an \"unsafe\" execution path, we have disabled this by default, and self-hosted administrators must add it to the [`allowedUnsafeExecutions`](https://docs.renovatebot.com/self-hosted-configuration/#allowedunsafeexecutions) allowlist.\n\nIt is recommended to review whether you have enabled this functionality for these managers, and if so, whether any dependency updates may have led to remote code execution.\n\n## Impact\n\nIf Renovate suggested an update to a malicious dependency, _and_ that dependency is referenced as part of the `bazel mod deps` call - for instance as part of a `ctx.execute` call - this would call attacker-controlled code.\n\nThis could lead to [insider attackers](https://docs.renovatebot.com/security-and-permissions/#execution-of-code-insider-attack) and [outside attackers](https://docs.renovatebot.com/security-and-permissions/#execution-of-code-outsider-attack), executing code that is distributed as part of the package.\n \n## Patches\n\nThis is patched in [43.102.11](https://github.com/renovatebot/renovate/releases/tag/43.102.11).\n\nThis does not affect any versions of [Mend Renovate Self-Hosted](https://www.mend.io/renovate/).\n\n## Workarounds\n\n- Upgrade your Renovate version\n- Disable `lockFileMaintenance` for these managers\n\n## Why did this happen?\n\nThis was missed in code review (as part of https://github.com/renovatebot/renovate/pull/41507).","status":"published","published":"2026-04-16T01:34:39Z","modified":"2026-04-16T01:34:40Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:54.128054Z"},{"id":"GHSA-7g3f-prg4-fg23","title":"Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in...","description":"Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.","status":"published","published":"2026-08-19T15:32:34Z","modified":"2026-08-19T15:32:38Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:10:39.892418Z"}],"nvd":[{"id":"CVE-2026-76226","description":"Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.","status":"published","published":"2026-08-19T14:17:49.157Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:39.962615Z"}],"osv":[{"id":"CVE-2026-76226","title":"Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance","description":"Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.","status":"published","published":"2026-08-19T14:02:08.689Z","modified":"2026-10-28T02:30:22.406638898Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"GHSA-5vjq-5jmg-39xq","title":"Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance","description":"When using [`lockFileMaintenance`](https://docs.renovatebot.com/configuration-options/#lockfilemaintenance) using the [bazel-module](https://docs.renovatebot.com/modules/manager/bazel-module/) or [bazelisk](https://docs.renovatebot.com/modules/manager/bazelisk/) managers between Renovate [43.65.0](https://github.com/renovatebot/renovate/releases/tag/43.65.0) (2026-03-12) and [43.102.11](https://github.com/renovatebot/renovate/releases/tag/43.102.11) (2026-04-02), there was the opportunity for remote code execution from a malicious dependency, _if the Bazel module executes code that relies on a dependency_.\n\nAs this is an \"unsafe\" execution path, we have disabled this by default, and self-hosted administrators must add it to the [`allowedUnsafeExecutions`](https://docs.renovatebot.com/self-hosted-configuration/#allowedunsafeexecutions) allowlist.\n\nIt is recommended to review whether you have enabled this functionality for these managers, and if so, whether any dependency updates may have led to remote code execution.\n\n## Impact\n\nIf Renovate suggested an update to a malicious dependency, _and_ that dependency is referenced as part of the `bazel mod deps` call - for instance as part of a `ctx.execute` call - this would call attacker-controlled code.\n\nThis could lead to [insider attackers](https://docs.renovatebot.com/security-and-permissions/#execution-of-code-insider-attack) and [outside attackers](https://docs.renovatebot.com/security-and-permissions/#execution-of-code-outsider-attack), executing code that is distributed as part of the package.\n \n## Patches\n\nThis is patched in [43.102.11](https://github.com/renovatebot/renovate/releases/tag/43.102.11).\n\nThis does not affect any versions of [Mend Renovate Self-Hosted](https://www.mend.io/renovate/).\n\n## Workarounds\n\n- Upgrade your Renovate version\n- Disable `lockFileMaintenance` for these managers\n\n## Why did this happen?\n\nThis was missed in code review (as part of https://github.com/renovatebot/renovate/pull/41507).","status":"published","published":"2026-04-16T01:34:39Z","modified":"2026-08-20T04:04:10.378838427Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:38.911014Z"}]}}