Skip to content
OpenAdvisories

Package · npm

turbo

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.1
    CVE-2026-45773

    Turborepo: Login callback CSRF/session fixation

    Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authenticat…

    vercel turborepo langfuse-3-worker turbo Wolfi npm
  • None 0.0
    CVE-2026-45772

    Turborepo: Unexpected local code execution during Yarn Berry detection

    Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affecte…

    vercel @turbo turborepo workspaces Wolfi npm