Skip to content
OpenAdvisories

Package · npm

turbo

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.1
    CVE-2026-45773

    Turborepo: Login callback CSRF/session fixation

    Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authenticat…

    vercel turborepo langfuse-3-worker turbo Wolfi npm