Is CVE-2026-76226 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-76226?

CVE-2026-76226 has a CVSS v3 severity of MEDIUM (6.3).

Back

CVE-2026-76226

Description

Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.