CVE-2026-45773

MediumCVSS 6.5

Published: 15/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

Turborepo is a build system for JavaScript and TypeScript. Prior to 2.9.14, self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback; a malicious web page could send a request with an attacker-controlled token, and the CLI could complete login with the wrong credentials. This is fixed in 2.9.14.

Risk Assessment

An attacker may cause the CLI to log in with the wrong credentials, potentially leading to unauthorized access to the remote cache/auth endpoint.

Recommendation

Update Turborepo to version 2.9.14 or later.

Other vulnerabilities in Turborepo

CVE-2026-45772Critical
Turborepo, a build system for JavaScript and TypeScript codebases, is vulnerable to arbitrary code execution in versions from 1.1.0 to before 2.9.14 when run in untrusted repositories containing malicious Yarn configuration. Package manager detection executes yarn --version, which could lead to loading and executing code from .yarnrc.yml controlled by an attacker.

Original NVD description (English source)

Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If accepted before the legitimate callback, the CLI could complete login with the wrong credentials. This affects users authenticating the turbo CLI against self-hosted remote cache/auth endpoints. Vercel-hosted login flows using device authorization are not affected. This vulnerability is fixed in 2.9.14.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS