https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:04:04.898517+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-renovate-cve-2026-76230 BREW-renovate-CVE-2026-76230 — Renovate 35.63.0 before 40.33.0 Command Injection via npm 2026-10-03T12:04:04.963026+00:00

Affected: Homebrew: renovate

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate.

 https://cve.radiocsirt.org/vuln/euvd-2026-357494 EUVD-2026-357494 2026-10-03T12:04:04.963084+00:00 EUVD-2026-357494 https://cve.radiocsirt.org/vuln/fkie_cve-2026-76230 fkie_cve-2026-76230 2026-10-03T12:04:04.963101+00:00

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate.

 https://cve.radiocsirt.org/vuln/ghsa-8rp2-gc6p-4hgp GHSA-8rp2-gc6p-4hgp 2026-10-03T12:04:04.963127+00:00

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration files to execute arbitrary commands on the machine running Renovate.