Executive brief
Turborepo is a build system used to manage large JavaScript and TypeScript projects. When running in untrusted repositories, it can execute arbitrary code if the repository contains a malicious Yarn configuration file (.yarnrc.yml) that defines a custom yarnPath. An attacker who controls repository contents could achieve full code execution when developers or CI/CD systems run Turborepo commands.
Technical details
This vulnerability is a code injection flaw (CWE-426: Untrusted Search Path) in Turborepo's package manager detection logic. The vulnerability occurs during Yarn Berry detection when Turborepo executes `yarn --version` directly from the project directory to identify the Yarn version. Yarn can be configured via .yarnrc.yml to load a project-controlled executable via the yarnPath setting, which Turborepo unintentionally triggers. An attacker who can control repository contents can place a malicious .yarnrc.yml file that points yarnPath to an arbitrary executable, causing code execution with the privileges of the user running Turborepo (often a CI/CD system with elevated permissions). The fix eliminates command execution during detection by instead inferring Yarn version and paths from metadata (package.json, parsing .yarnrc.yml without execution, and yarn.lock), rejecting unrecognized Yarn lockfile formats rather than falling back to execution. The vulnerability affects turbo 1.1.0–2.9.13, @turbo/codemod 2.3.4–2.9.13, and @turbo/workspaces 2.3.4–2.9.13, with patches available in version 2.9.14 and later.
Affected products
- Vercel turbo >=1.1.0, <2.9.14
- Vercel @turbo/codemod >=2.3.4, <2.9.14
- Vercel @turbo/workspaces >=2.3.4, <2.9.14
Timeline
- 2026-05-19: disclosed: Advisory published
- 2026-05-19: patched: Fix released in version 2.9.14