# renovate (npm) vulnerabilities

11 known vulnerabilities (9 high, 2 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Weekly downloads: 559.3K
- Registry: https://www.npmjs.com/package/renovate

## Advisories (11)

### [CVE-2026-76233](https://cve.now/CVE-2026-76233): Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager

- Severity: High 8.4
- Published: Aug 19, 2026
- Affected: from 39.53.0, fixed in 40.33.0.

### [CVE-2026-76232](https://cve.now/CVE-2026-76232): Renovate 31.51.0 before 40.33.0 Command Injection via helmv3

- Severity: High 8.4
- Published: Aug 19, 2026
- Affected: from 31.51.0, fixed in 40.33.0.

### [CVE-2026-76231](https://cve.now/CVE-2026-76231): Renovate 32.135.0 before 40.33.0 Command Injection via hermit

- Severity: High 8.4
- Published: Aug 19, 2026
- Affected: from 32.135.0, fixed in 40.33.0.

### [CVE-2026-76230](https://cve.now/CVE-2026-76230): Renovate 35.63.0 before 40.33.0 Command Injection via npm

- Severity: High 8.4
- Published: Aug 19, 2026
- Affected: from 35.63.0, fixed in 40.33.0.

### [CVE-2026-76229](https://cve.now/CVE-2026-76229): Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

- Severity: High 8.4
- Published: Aug 19, 2026
- Affected: from 39.218.0, fixed in 40.33.0.

### [CVE-2026-76228](https://cve.now/CVE-2026-76228): Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper

- Severity: High 8.4
- Published: Aug 19, 2026
- Affected: from 32.124.0, fixed in 42.68.5.

### [CVE-2026-76227](https://cve.now/CVE-2026-76227): Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure

- Severity: Medium 6.8
- Published: Aug 19, 2026
- Affected: from 42.68.1, fixed in 42.96.3; from 43.0.0, fixed in 43.4.4.

### [CVE-2026-76226](https://cve.now/CVE-2026-76226): Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance

- Severity: Medium 6.8
- Published: Aug 19, 2026
- Affected: from 43.65.0, fixed in 43.102.11.

### [CVE-2024-58376](https://cve.now/CVE-2024-58376): Renovate 37.158.0 before 37.199.0 Command Injection via helmv3

- Severity: High 8.4
- Published: Aug 19, 2026
- Affected: from 37.158.0, fixed in 37.199.0.

### [CVE-2020-37267](https://cve.now/CVE-2020-37267): Renovate 19.180.0 before 23.25.1 Token Leakage via Logs

- Severity: High 8.7
- Published: Aug 19, 2026
- Affected: from 19.180.0, fixed in 23.25.1.

### [CVE-2019-25766](https://cve.now/CVE-2019-25766): Renovate before 19.38.7 Credential Exposure via Go Modules

- Severity: High 8.7
- Published: Aug 19, 2026
- Affected: from 13.87.0, fixed in 19.38.7.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/renovate
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.