CVE-2026-45772

Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vercel:turborepo:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Turborepo es un sistema de compilación de alto rendimiento para bases de código JavaScript y TypeScript. Desde la 1.1.0 hasta antes de la 2.9.14, Turborepo puede ser vulnerable a la ejecución de código arbitrario cuando se ejecuta en repositorios no confiables que contienen una configuración de Yarn maliciosa. En las versiones afectadas, la detección del gestor de paquetes ejecutaba yarn --version desde el directorio del proyecto, lo que podría hacer que Yarn cargara y ejecutara un yarnPath controlado por el proyecto desde .yarnrc.yml. Un atacante que controla el contenido del repositorio podría causar la ejecución de código cuando un usuario o sistema de CI ejecuta los comandos de conversión afectados turbo, @turbo/codemod o @turbo/workspace. Esta vulnerabilidad se corrige en la versión 2.9.14.

Information

Published : 2026-05-15 16:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-45772

Mitre link : CVE-2026-45772

CVE.ORG link : CVE-2026-45772

JSON object : View

Products Affected

vercel

turborepo

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2026-45772", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45772", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T17:53:36.882524Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 0.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "vercel", "product": "turborepo", "versions": [{"status": "affected", "version": ">= 1.1.0, < 2.9.14"}]}, {"vendor": "@turbo", "product": "codemod", "versions": [{"status": "affected", "version": ">= 2.3.4, < 2.9.14"}]}, {"vendor": "@turbo", "product": "workspaces", "versions": [{"status": "affected", "version": ">= 2.3.4, < 2.9.14"}]}]}], "published": "2026-05-15T16:16:14.987", "references": [{"url": "https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14."}, {"lang": "es", "value": "Turborepo es un sistema de compilaci\u00f3n de alto rendimiento para bases de c\u00f3digo JavaScript y TypeScript. Desde la 1.1.0 hasta antes de la 2.9.14, Turborepo puede ser vulnerable a la ejecuci\u00f3n de c\u00f3digo arbitrario cuando se ejecuta en repositorios no confiables que contienen una configuraci\u00f3n de Yarn maliciosa. En las versiones afectadas, la detecci\u00f3n del gestor de paquetes ejecutaba yarn --version desde el directorio del proyecto, lo que podr\u00eda hacer que Yarn cargara y ejecutara un yarnPath controlado por el proyecto desde .yarnrc.yml. Un atacante que controla el contenido del repositorio podr\u00eda causar la ejecuci\u00f3n de c\u00f3digo cuando un usuario o sistema de CI ejecuta los comandos de conversi\u00f3n afectados turbo, @turbo/codemod o @turbo/workspace. Esta vulnerabilidad se corrige en la versi\u00f3n 2.9.14."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vercel:turborepo:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "DF294351-4488-43A9-B86D-5A5A1F922A2B", "versionEndExcluding": "2.9.14", "versionStartIncluding": "1.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}