CVE-2026-46508 Details
Description
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute shell commands derived from workspace-controlled values. The extension used string-based command execution for Turborepo daemon commands and task runs. A malicious workspace could provide crafted values through workspace settings or task names in the repository's source code that were interpolated into shell commands. When the extension activated or when a user ran a task through the extension, those values could be interpreted by the user's shell, allowing arbitrary command execution with the privileges of the local VS Code process. This vulnerability is fixed in 2.9.14000.
A command injection vulnerability has been identified in the Turborepo LSP VS Code extension, affecting versions through 2.9.12000. The issue arises from the extension's use of string-based command execution for Turborepo daemon commands and task runs. A malicious workspace could introduce crafted values through workspace settings or task names, which would be interpolated into shell commands. When the extension was activated or a task was run, these values could be executed by the user's shell, allowing arbitrary command execution with the privileges of the local VS Code process.
Users can upgrade to Turborepo LSP VS Code extension version 2.9.14000 or later. If an immediate upgrade is not possible, the extension can be disabled when opening untrusted workspaces and avoid running Turborepo tasks from the extension in repositories that are not trusted.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vercel/turborepo/security/advisories/GHSA-5xc8-49mv-x4mm | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vercel turborepo language server protocol | < 2.9.14000 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | Reanalysis | [email protected] |
| May 19, 2026 | Initial Analysis | [email protected] |
| May 15, 2026 | New CVE Received | [email protected] |