CVE-2026-45772 Details
Description
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14.
A vulnerability allowing arbitrary code execution has been identified in Turborepo versions 1.1.0 prior to 2.9.14. This issue arises when Turborepo is run in untrusted repositories containing malicious Yarn configuration. The vulnerability exploits the package manager detection process, which executes 'yarn --version' from the project directory. This can lead Yarn to load and execute a user-controlled 'yarnPath' from '.yarnrc.yml'. An attacker controlling the repository contents could trigger code execution when affected Turborepo commands are executed.
Users can upgrade to Turborepo version 2.9.14 or later to address this vulnerability. If an immediate upgrade is not possible, it is recommended to avoid running Turborepo commands in untrusted repositories and to review or remove any '.yarnrc.yml' files that specify 'yarnPath' before executing Turborepo, particularly in CI or automated environments that handle external projects.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-426 | Untrusted Search Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vercel turborepo | >= 1.1.0, < 2.9.14 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | Initial Analysis | [email protected] |
| May 15, 2026 | New CVE Received | [email protected] |