CVE-2026-45772: Vercel Turborepo arbitrary code execution via malicious Yarn configuration

CVE-2026-45772 · Severity: critical · CVSS 9.8 · Published 2026-05-15

Turborepo is a build system used to manage large JavaScript and TypeScript projects. When running in untrusted repositories, it can execute arbitrary code if the repository contains a malicious Yarn configuration file (.yarnrc.yml) that defines a custom yarnPath. An attacker who controls repository contents could achieve full code execution when developers or CI/CD systems run Turborepo commands.

Technologies: Vercel Turbo. Vendors: Vercel.

Quick answers

Is CVE-2026-45772 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45772 being exploited in the wild.
How severe is CVE-2026-45772?
Critical severity, with a CVSS score of 9.8, published 15 May 2026.
Which products and versions are affected?
Vercel @Turbo/Codemod >= 2.3.4, < 2.9.14, >=2.3.4, <2.9.14, 2.3.4 to < 2.9.14; Vercel @Turbo/Workspaces >= 2.3.4, < 2.9.14, >=2.3.4, <2.9.14, 2.3.4 to < 2.9.14; Vercel Turbo >= 1.1.0, < 2.9.14, >=1.1.0, <2.9.14, 1.1.0 to < 2.9.14.
Is there a fix for CVE-2026-45772?
A patch was published on 2026-05-19: Fix released in version 2.9.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45772 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45772?
Check whether you run Vercel @Turbo/Codemod, Vercel @Turbo/Workspaces or Vercel Turbo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a code injection flaw (CWE-426: Untrusted Search Path) in Turborepo's package manager detection logic. The vulnerability occurs during Yarn Berry detection when Turborepo executes `yarn --version` directly from the project directory to identify the Yarn version. Yarn can be configured via .yarnrc.yml to load a project-controlled executable via the yarnPath setting, which Turborepo unintentionally triggers. An attacker who can control repository contents can place a malicious .yarnrc.yml file that points yarnPath to an arbitrary executable, causing code execution with the privileges of the user running Turborepo (often a CI/CD system with elevated permissions). The fix eliminates command execution during detection by instead inferring Yarn version and paths from metadata (package.json, parsing .yarnrc.yml without execution, and yarn.lock), rejecting unrecognized Yarn lockfile formats rather than falling back to execution. The vulnerability affects turbo 1.1.0–2.9.13, @turbo/codemod 2.3.4–2.9.13, and @turbo/workspaces 2.3.4–2.9.13, with patches available in version 2.9.14 and later.

Affected products

  • Vercel turbo >=1.1.0, <2.9.14
  • Vercel @turbo/codemod >=2.3.4, <2.9.14
  • Vercel @turbo/workspaces >=2.3.4, <2.9.14

Identifiers

  • CVE-2026-45772
  • GHSA-3qcw-2rhx-2726

Timeline

  • 2026-05-19: disclosed: Advisory published
  • 2026-05-19: patched: Fix released in version 2.9.14

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.