CVE-2026-88886

Renovate's gradle-wrapper manager passes the distributionUrl value from a repository's gradle/wrapper/gradle-wrapper.properties file to the Gradle Wrapper CLI without escaping it, so shell metacharacters embedded in that URL are interpreted as commands (CWE-78, OS command injection). An attacker who can set a crafted distributionUrl (for example by appending a shell metacharacter and command) in a repository processed by a vulnerable instance can cause arbitrary command execution as the Renovate user when Renovate handles a Gradle Wrapper update, potentially exposing the host and the credentials Renovate uses. Only self-hosted deployments configured with binarySource=docker and with 'gradleWrapper' listed in allowedUnsafeExecutions are affected per the advisory; hosted or differently configured instances are not described as affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known. The flaw is fixed in Renovate 44.14.7, Mend Renovate CE/EE 15.4.0, and the mend-renovate-enterprise-edition Helm chart 10.4.0.

What to do: Upgrade self-hosted Renovate to 44.14.7 or later, Mend Renovate CE/EE to 15.4.0 or later, or the mend-renovate-enterprise-edition Helm chart to 10.4.0 or later. As an immediate workaround, remove 'gradleWrapper' from allowedUnsafeExecutions in any self-hosted configuration. Audit whether your instance uses the vulnerable configuration and whether managed repositories contain gradle/wrapper/gradle-wrapper.properties, and review host logs for unexpected commands run as the Renovate user.