CVE-2026-45772: Turborepo: Unexpected local code execution during Yarn Berry detection
Impact
Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands.
Fix
Turbo now avoids executing project-local Yarn during package manager detection. Yarn versions and paths are inferred from metadata such as package.json, parsing the value of yarnPath in .yarnrc.yml rather than executing it, and yarn.lock, and unrecognized Yarn lockfile formats are rejected instead of falling back to executing yarn.
Workarounds
If you cannot upgrade immediately, do not run Turborepo commands in untrusted repositories. Review or remove .yarnrc.yml files that define yarnPath before running Turborepo, especially in CI or automated tooling that processes external projects.
Other sources
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45772?
CVE-2026-45772 has a severity level classified as low with a CVSS score of 4.0.
What impact does CVE-2026-45772 have?
CVE-2026-45772 can lead to arbitrary code execution in untrusted repositories containing malicious Yarn configuration.
How can I mitigate CVE-2026-45772?
To mitigate CVE-2026-45772, avoid running Turborepo in untrusted project repositories that might contain harmful Yarn configurations.
Which versions of Turborepo are affected by CVE-2026-45772?
CVE-2026-45772 affects certain versions of Turborepo that utilize Yarn for package manager detection.
Is there a known fix for CVE-2026-45772?
As of now, updating Turborepo to a patched version or following best practices for repository trustworthiness is recommended to address CVE-2026-45772.