@turbo workspaces vulnerabilities

Latest @turbo workspaces CVEs

Newest publication first

1. CVE-2026-45772 Turborepo: Unexpected local code execution during Yarn Berry detection

   Published 2026-05-15

   None·CVSS 0.0 EPSS 0.39%

   Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package m...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.