Executive brief
Turborepo is a build system used by developers to manage JavaScript and TypeScript projects. A vulnerability in its Visual Studio Code extension allows a malicious project to execute unauthorized commands on a developer's computer. If a developer opens a compromised repository or runs a task within it, an attacker could gain full control over the developer's local environment, potentially stealing source code, credentials, or interfering with development operations.
Technical details
A command injection vulnerability exists in the Turborepo LSP VS Code extension due to improper neutralization of workspace-controlled values during shell command interpolation. The extension used string-based execution for daemon commands and task runs, allowing malicious values in workspace settings or repository task names to be interpreted by the user's shell. An attacker can achieve arbitrary command execution with the privileges of the local VS Code process by tricking a user into opening a malicious workspace or executing a task. The issue is resolved in version 2.9.14000 by switching to execFile with explicit arguments, using structured terminal options, and disabling the extension in untrusted workspaces.
Affected products
- Vercel Turborepo LSP (VS Code Extension) < 2.9.14000
Timeline
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-05-15: disclosed: NVD publication date