Remote Code Execution Vulnerability in Yeger Turbo-Graph Package

CVE-2026-59160

What is CVE-2026-59160?

The Yeger turbo-graph package, prior to version 2.8.9, is susceptible to a remote code execution flaw due to its embedded Next.js server and improper authentication. This vulnerability allows attackers on adjacent networks to exploit an exposed API endpoint. Without adequate safeguards like authentication and CSRF protection, it enables attackers to execute any tasks defined in the project's turbo.json file with the permissions of the developer's operating system user. Consequently, this exposure could lead to unauthorized access to sensitive information, modification of files, or potential disruptions in service availability. This issue has been remediated in version 2.8.9.

References