turborepo vulnerabilities

2 known vulnerabilities in turborepo from Vercel. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  turborepo: Improper Neutralization of Special Elements used in a Command

  CVE-2026-46508May 15, 2026Vercel

  Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute shell commands derived from workspace-controlled values. The extension used string-based command executi

• 9.8 Critical severity

  turborepo: Untrusted Search Path

  CVE-2026-45772May 15, 2026Vercel

  Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected