CVE-2026-88886

Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0), the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository's gradle/wrapper/gradle-wrapper.properties file before invoking the Gradle Wrapper CLI. In self-hosted deployments configured with binarySource=docker and allowedUnsafeExecutions=['gradleWrapper', ...], a repository that supplies a crafted distributionUrl (for example, appending a shell metacharacter and command) can cause arbitrary commands to be executed as the Renovate user when Renovate processes a Gradle Wrapper update. The issue is fixed in Renovate 44.14.7; as a workaround, remove 'gradleWrapper' from allowedUnsafeExecutions.

• CWE-78

• https://github.com/renovatebot/renovate/security/advisories/GHSA-7chm-46wx-888m
• https://www.vulncheck.com/advisories/renovate-before-44.14.7-command-injection-via-gradle-wrapper

Published

Sep 10, 2026

Last Modified

Sep 15, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88880Renovate before 44.11.3 fails to validate Link header destin…8.6
• CVE-2026-88881Renovate, a dependency update tool, follows pagination links…8.6
• CVE-2026-88882Renovate is a dependency update automation tool. In versions…8.6
• CVE-2026-88883Renovate is an automated dependency update tool. In versions…7.7
• CVE-2026-88884Renovate is a dependency update automation tool. In versions…5.8
• CVE-2026-88885Renovate before 44.14.7 contains a command injection vulnera…7
• CVE-2026-88887Renovate is a dependency update automation tool. When listin…8.6
• CVE-2026-88888Renovate before 44.14.7 contains a command injection vulnera…7
• CVE-2026-88889Renovate before 44.14.7 contains a command injection vulnera…7.8
• CVE-2026-8889Version 3.0.7 of the Securly Chrome Extension uses deprecate…7.5
• CVE-2026-88890OpenPanel through commit cd24bb8 contains an SQL injection v…8.5
• CVE-2026-88891OpenPanel fails to enforce read-only project access level on…8.3