CVE-2026-45772

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45772", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T07:45:21.251Z", "datePublished": "2026-05-15T15:45:45.252Z", "dateUpdated": "2026-05-15T17:54:06.401Z"}, "containers": {"cna": {"title": "Turborepo: Unexpected local code execution during Yarn Berry detection", "problemTypes": [{"descriptions": [{"cweId": "CWE-426", "lang": "en", "description": "CWE-426: Untrusted Search Path", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 0, "baseSeverity": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726"}], "affected": [{"vendor": "vercel", "product": "turborepo", "versions": [{"version": ">= 1.1.0, < 2.9.14", "status": "affected"}]}, {"vendor": "@turbo", "product": "codemod", "versions": [{"version": ">= 2.3.4, < 2.9.14", "status": "affected"}]}, {"vendor": "@turbo", "product": "workspaces", "versions": [{"version": ">= 2.3.4, < 2.9.14", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-15T15:47:12.753Z"}, "descriptions": [{"lang": "en", "value": "Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14."}], "source": {"advisory": "GHSA-3qcw-2rhx-2726", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-15T17:53:36.882524Z", "id": "CVE-2026-45772", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T17:54:06.401Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45772", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T17:53:36.882524Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T17:53:41.012Z"}}], "cna": {"title": "Turborepo: Unexpected local code execution during Yarn Berry detection", "source": {"advisory": "GHSA-3qcw-2rhx-2726", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 0, "attackVector": "NETWORK", "baseSeverity": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "vercel", "product": "turborepo", "versions": [{"status": "affected", "version": ">= 1.1.0, < 2.9.14"}]}, {"vendor": "@turbo", "product": "codemod", "versions": [{"status": "affected", "version": ">= 2.3.4, < 2.9.14"}]}, {"vendor": "@turbo", "product": "workspaces", "versions": [{"status": "affected", "version": ">= 2.3.4, < 2.9.14"}]}], "references": [{"url": "https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726", "name": "https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-426", "description": "CWE-426: Untrusted Search Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-15T15:47:12.753Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45772", "state": "PUBLISHED", "dateUpdated": "2026-05-15T17:54:06.401Z", "dateReserved": "2026-05-13T07:45:21.251Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-15T15:45:45.252Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "turborepo", "vendor": "vercel", "versions": [{"status": "affected", "version": ">= 1.1.0, < 2.9.14"}]}, {"product": "codemod", "vendor": "@turbo", "versions": [{"status": "affected", "version": ">= 2.3.4, < 2.9.14"}]}, {"product": "workspaces", "vendor": "@turbo", "versions": [{"status": "affected", "version": ">= 2.3.4, < 2.9.14"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vercel:turborepo:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "DF294351-4488-43A9-B86D-5A5A1F922A2B", "versionEndExcluding": "2.9.14", "versionStartIncluding": "1.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14."}, {"lang": "es", "value": "Turborepo es un sistema de compilaci\u00f3n de alto rendimiento para bases de c\u00f3digo JavaScript y TypeScript. Desde la 1.1.0 hasta antes de la 2.9.14, Turborepo puede ser vulnerable a la ejecuci\u00f3n de c\u00f3digo arbitrario cuando se ejecuta en repositorios no confiables que contienen una configuraci\u00f3n de Yarn maliciosa. En las versiones afectadas, la detecci\u00f3n del gestor de paquetes ejecutaba yarn --version desde el directorio del proyecto, lo que podr\u00eda hacer que Yarn cargara y ejecutara un yarnPath controlado por el proyecto desde .yarnrc.yml. Un atacante que controla el contenido del repositorio podr\u00eda causar la ejecuci\u00f3n de c\u00f3digo cuando un usuario o sistema de CI ejecuta los comandos de conversi\u00f3n afectados turbo, @turbo/codemod o @turbo/workspace. Esta vulnerabilidad se corrige en la versi\u00f3n 2.9.14."}], "id": "CVE-2026-45772", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 0.0, "baseSeverity": "NONE", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45772", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-15T17:53:36.882524Z", "version": "2.0.3"}}]}, "published": "2026-05-15T16:16:14.987", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-426"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.3.4,2.9.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "codemod", "source": "cna", "vendor": "@turbo"}, "product": "codemod", "vendor": "@turbo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.3.4,2.9.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "workspaces", "source": "cna", "vendor": "@turbo"}, "product": "workspaces", "vendor": "@turbo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.1.0,2.9.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "turborepo", "source": "cna", "vendor": "vercel"}, "product": "turborepo", "vendor": "vercel"}], "created": "2026-05-15T18:00:05.567857+00:00", "updated": "2026-05-19T16:15:09.138207+00:00", "vendors": ["@turbo", "@turbo$PRODUCT$codemod", "@turbo$PRODUCT$workspaces", "vercel", "vercel$PRODUCT$turborepo"]}