Arbitrary Code Execution in Turborepo Build System for JavaScript and TypeScript
CVE-2026-45772

NONE

Key Information:

Vendor

Vercel
Status
Turborepo
Codemod
Workspaces
Vendor
CVE Published:
15 May 2026

What is CVE-2026-45772?

Turborepo versions from 1.1.0 to before 2.9.14 are susceptible to an arbitrary code execution vulnerability. When run in untrusted environments containing malicious Yarn configurations, the affected Turborepo versions execute 'yarn --version' from the project directory. This operation can allow for the execution of a project-specified 'yarnPath' from .yarnrc.yml, potentially letting an attacker control what code is executed when a user or CI system invokes specific conversion commands. The vulnerability is mitigated in version 2.9.14.

Affected Version(s)

codemod >= 2.3.4, < 2.9.14

turborepo >= 1.1.0, < 2.9.14

workspaces >= 2.3.4, < 2.9.14

References

https://github.com/vercel/turborepo/security/advisories/G...
x_refsource_CONFIRM

CVSS V4

Score:
Severity:
NONE
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.