CVE-2026-76226
MEDIUM
NVD
CVSS Score
6.3
Severity
MEDIUM
Published
Aug 19, 2026
Vendor
unknown
Description
Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.