CVE-2026-76226 — Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can…
Published: 2026-08-19 · CVSS: 6.8 · CVSS 4.0
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7