What’s Vulnerable › Vulnerabilities
CVE-2026-45772: Turborepo: Unexpected local code execution during Yarn Berry detection
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-15 · updated 2026-10-26
- Weakness: CWE-426
Description
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14.
Affected products
- vercel turborepo: from 1.1.0 before 2.9.14 — fixed in 2.9.14
How to fix
Upgrade to a fixed version: vercel turborepo 2.9.14. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-45772 or the next vulnerability affects your stack