Executive brief
@yeger/turbo-graph is a web-based UI for visualizing and executing Turborepo build tasks. The tool's embedded web server listens on all network interfaces by default and exposes an unauthenticated HTTP endpoint that accepts arbitrary task names from the network. An attacker on the same network segment can send a simple HTTP request to execute any build task defined in a developer's project, leading to code execution, data theft, or infrastructure compromise with the developer's privileges.
Technical details
This vulnerability combines two flaws: (1) the embedded Next.js server calls .listen(port) without binding to a specific hostname, causing Node.js to default to 0.0.0.0 (all interfaces) instead of localhost; (2) the /api/run endpoint (packages/turbo-graph-ui/app/api/run/route.ts:156–177) reads task names from untrusted query parameters and passes them directly to spawn() with no authentication, authorization, CSRF protection, or allowlist checks. An adjacent-network attacker can send an unauthenticated GET request to /api/run?tasks=<taskname> to trigger arbitrary Turborepo tasks. Although spawn() is invoked with an argument array (not a shell string), preventing shell injection, the attacker can execute any task defined in turbo.json in the victim's project directory with the developer's OS privileges. Fixed in version 2.8.12.
Affected products
- @yeger turbo-graph <= 2.8.8
Timeline
- 2026-06-20: disclosed
- 2026-09-09: advisory
- 2026-09-09: patched: version 2.8.12 fixes the vulnerability