CVE-2026-45772noneCWE-426

CVE-2026-45772: vulnerability in vercel turborepo

Turborepo: Unexpected local code execution during Yarn Berry detection

Published

Follow this CVE+ Monitor turborepo+ Monitor codemod

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 0epss 0.4%
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
@turbo · codemod@turbo · workspacesvercel · turborepo
Related CVEs — vercel turborepo

In the same product, most dangerous first.

CVE-2026-46508HIGHTurborepo: VSCode Extension command injectionEPSS 0.2%CVE-2026-45773MEDIUMTurborepo: Login callback CSRF/session fixationEPSS 0.1%