Arbitrary Command Execution Vulnerability in Turborepo LSP for VS Code by Vercel

CVE-2026-46508

What is CVE-2026-46508?

The Turborepo LSP VS Code extension prior to version 2.9.14000 contains a vulnerability that allows for arbitrary command execution. This occurs when the extension utilizes string-based command execution for executing tasks, which can be exploited by maliciously crafted values from workspace settings or task names. When a user activates the extension or triggers a task, these values are interpolated into shell commands, enabling unauthorized command execution with the privileges of the local VS Code process. The vulnerability highlights the risks associated with workspace-controlled values and underscores the importance of using secure coding practices in extensions and plugins.

References