Executive brief
Turborepo is a build system used to manage and speed up JavaScript and TypeScript projects. A security flaw in its login process for self-hosted environments could allow a malicious website to hijack a developer's authentication session. If exploited, a developer's local command-line tool could be logged into an attacker's account instead of their own, potentially leading to the exposure of build data or incorrect configuration.
Technical details
Turborepo's CLI (turbo) fails to validate a CSRF 'state' parameter during the localhost callback phase of the browser-based SSO/login flow. An attacker can host a malicious webpage that sends a forged request containing an attacker-controlled token to the local callback server (typically listening on a high port on localhost) while the user is attempting to authenticate. If the malicious request reaches the CLI before the legitimate one, the CLI will adopt the attacker's session. This vulnerability specifically affects self-hosted remote cache/auth configurations; Vercel-hosted flows using device authorization are not impacted. The issue is fixed in version 2.9.14 by implementing mandatory state validation.
Affected products
- Vercel turbo <= 2.9.13
Timeline
- 2026-05-14: advisory: Initial advisory published by Vercel
- 2026-05-15: disclosed: CVE-2026-45773 published to NVD
- 2026-05-19: patched: GitHub Advisory reviewed and updated