High 7.8Published Sep 10, 2026

CVE-2026-88886Renovate before 44.14.7 Command Injection via gradle-wrapper

Updated under an hour ago (2026-10-19 08:30 UTC)

Does this affect you?

It affects renovatebot renovate and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for renovatebot renovate

Exploited in the last 30 days

Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0), the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository's gradle/wrapper/gradle-wrapper.properties file before invoking the Gradle Wrapper CLI. In self-hosted deployments configured with binarySource=docker and allowedUnsafeExecutions=['gradleWrapper', ...], a repository that supplies a crafted distributionUrl (for example, appending a shell metacharacter and command) can cause arbitrary commands to be executed as the Renovate user when Renovate processes a Gradle Wrapper update. The issue is fixed in Renovate 44.14.7; as a workaround, remove 'gradleWrapper' from allowedUnsafeExecutions.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-78
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Awaiting Analysis
Record last updated: Sep 29, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

renovatebot renovate renovatebot:renovate (from the name)	before 44.14.7; 44.14.7 not affected	CNA record
mend renovate-ce mend:renovate_ce (from the name)	before 15.4.0; 15.4.0 not affected	CNA record
mend renovate-ee-server mend:renovate_ee_server (from the name)	before 15.4.0; 15.4.0 not affected	CNA record
mend renovate-ee-worker mend:renovate_ee_worker (from the name)	before 15.4.0; 15.4.0 not affected	CNA record
mend mend-renovate-enterprise-edition mend:renovate_enterprise_edition (from the name)	before 10.4.0; 10.4.0 not affected	CNA record

References

https://github.com/renovatebot/renovate/security/advisories/GHSA-7chm-46wx-888mvendor-advisory
https://www.vulncheck.com/advisories/renovate-before-44.14.7-command-injection-via-gradle-wrapperthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.