CVE-2026-45772
critical
CVSS v3
9.8
CVSS v2
—
VIR risk
9.8
Description
Turbo: Unexpected local code execution during Yarn Berry detection
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: security-advisories@github.com — https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| npm | turbo | >=1.1.0,<2.9.14 | 2.9.14 |
| npm | @turbo/codemod | >=2.3.4,<2.9.14 | 2.9.14 |
| npm | @turbo/workspaces | >=2.3.4,<2.9.14 | 2.9.14 |
| NPM | @turbo/workspaces | >= 2.3.4, < 2.9.14 | 2.9.14 |
| NPM | @turbo/codemod | >= 2.3.4, < 2.9.14 | 2.9.14 |
| NPM | turbo | >= 1.1.0, < 2.9.14 | 2.9.14 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| vercel | turborepo | {"startIncluding":"1.1.0","endExcluding":"2.9.14"} | 2.9.14 |
References
CWEs
CWE-426
Verify integrity in audit chain (admin only). AS-IS.