CVE-2026-45772

What it is

Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14.

At a glance

Exploitability

Can be exploited over the network without logging in. Limited direct impact.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-05-15 16:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-26 14:10 UTC Last updatedMost recent change to the record

Details

Published

2026-05-15 16:16 UTC

Last modified

2026-10-26 14:10 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-426

Record status

Analyzed

Affected

• Vercel Turborepo < 2.9.14

Attack profile CVSS 4.0 · 0.0

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

None