MEDIUMVulnerability

CVE-2026-76233

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate.

Properties

severity
MEDIUM
score
6.7
epss_score
0.00722
cve_id
CVE-2026-76233
vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
published_at
2026-08-19T14:17:50.957
last_modified
2026-09-08T20:28:37.587
epss_percentile
0.51676

Related Entities (3)

ENRICHED_BY (1)

[Source]FIRST EPSS

HAS_WEAKNESS (1)

[Weakness]Improper Neutralization of Special Elements used in a Command ('Command Injection')

DESCRIBED_BY (1)

[Source]NVD

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-76233 — Ninja Signal Threat Intelligence | Ninja Signal