{"apiVersion":"1.0","identifier":"CVE-2026-76226","description":"Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within ctx.execute statements.","publishedAt":"2026-08-19T14:17:49","lastModifiedAt":"2026-08-21T12:16:33","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76226","cvssScore":6.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","epssProbability":0.00214,"riskScore":0.64,"affectedProduct":"Renovate","affectedVersions":">=43.65.0,<43.102.11","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-76226","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-76226","en":"https://www.redsauce.net/en/cves/CVE-2026-76226","fr":"https://www.redsauce.net/fr/cves/CVE-2026-76226","pt":"https://www.redsauce.net/pt/cves/CVE-2026-76226","de":"https://www.redsauce.net/de/cves/CVE-2026-76226","sk":"https://www.redsauce.net/sk/cves/CVE-2026-76226","el":"https://www.redsauce.net/el/cves/CVE-2026-76226"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-76226"}}