CVE-2026-45772 is a code execution flaw in Turborepo. Running turbo in an untrusted repository with a hostile Yarn config can execute attacker code. NVD scores it 9.8 (critical). Turborepo 2.9.14 fixes it.
What's affected
NVD says Turborepo from 1.1.0 to before 2.9.14. The GitHub advisory breaks it down by package:
turbo: 1.1.0 and later@turbo/codemodand@turbo/workspaces: 2.3.4 and later
All three are fixed in 2.9.14.
Severity differs between sources. NVD lists CVSS 3.1 of 9.8, while the GitHub advisory rates it Low (CVSS v4 0.0). The gap comes from the precondition: someone has to run Turborepo on repository contents they do not control. For a team that only builds its own code, the exposure is small. For CI that builds forks, pull requests or third party projects, it is not.
How to check if you're exposed
npx turbo --version
npm ls turbo @turbo/codemod @turbo/workspaces
Then look at where Turborepo runs on code from outside your team: CI jobs for forked pull requests, tooling that clones customer repositories, and developers who inspect unknown projects. Search those repositories for a yarnPath entry in .yarnrc.yml.
grep -rn yarnPath .yarnrc.yml
What to do now
- Upgrade turbo,
@turbo/codemodand@turbo/workspacesto 2.9.14 or later. - Check pinned versions in lockfiles and in CI images, since global installs are easy to miss.
- Until you upgrade, avoid running Turborepo in untrusted repositories.
- Review or remove
.yarnrc.ymlfiles that defineyarnPathbefore running Turborepo, especially in CI that handles external projects. - For fork pull requests, run builds without secrets and with limited network access.
Why it matters
The weakness is CWE-426, untrusted search path. To detect which package manager a project uses, older Turborepo ran yarn --version from the project directory. Yarn then loaded a yarnPath set in the project's own .yarnrc.yml, which means project files chose what program ran.
The fix stops running the project local Yarn during detection and parses yarnPath instead. The KEV flag is false.
Quick check
Does this affect a normal turbo run build on my own repo?
Only if your repository contains a hostile Yarn config. The risk is cloning or checking out code you do not trust. Upgrading removes the question.
Sources
Last reviewed: 19 October 2026.
