Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@yeger/turbo-graph

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8npmAmendedPublished

    @yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

    CVE-2026-59160 · GHSA-2r5q-h53f-9rp3

    Affected
    • npm @yeger/turbo-graph <= 2.8.8
    Fixed in
    2.8.12· Vendor fix available
    Issue
    Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces (0.0.0.0:29312 by default). The /api/run HTTP endpoint exposed by this server performs no authentication, authorization, CSRF protection, or task allowlist check before executing attacker-supplied Turborepo task names via spawn(). Any adjacent-network attacker can send an unauthenticated GET request to trigger arbitrary tasks defined in the victim's repository, resulting in code execution, file modification, destructive build side effects, or deployment of attacker-chosen targets with the privileges of the developer's OS user. Details Two independent flaws combine to create a remotely exploitable unauthenticated code execution vulnerability: Flaw 1 — Server bound to all interfaces (not loopback) packages/turbo-graph/src/index.ts:44 calls .listen(options.port,…

    Recommended action: Upgrade to 2.8.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →