GHSA-3qcw-2rhx-2726
Critical · 9.8CVSS
9.8
EPSS
—
Published
May 19, 2026
CISA due date
—
The record
Turbo: Unexpected local code execution during Yarn Berry detection
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @turbo/codemod | 2.3.4 | 2.9.14 |
| npm | @turbo/workspaces | 2.3.4 | 2.9.14 |
| npm | turbo | 1.1.0 | 2.9.14 |
Related vulnerabilities
- CVE-2026-45772 Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Same vulnerability
- GHSA-hcf7-66rw-9f5r Trubo: Login callback CSRF/session fixation Also affects turbo
- CVE-2026-45773 Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Also affects turbo
- CVE-2026-0307 Multiple local privilege escalation vulnerabilities in the Palo Alto Networks… CWE-426
- CVE-2026-81192 `OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource… CWE-426
- CVE-2026-80159 Acrobat Reader is affected by an Untrusted Search Path vulnerability that could result in… CWE-426
- CVE-2026-84226 OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local… CWE-426
- CVE-2026-82862 Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root… CWE-426