PT-2026-41312 · Turborepo · Turborepo

Published 2026-05-15 · Updated 2026-05-19 · CVE-2026-45773

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Turborepo versions prior to 2.9.14

Description Turborepo is a high-performance build system for JavaScript and TypeScript codebases. The self-hosted login and SSO browser flows fail to validate a CSRF (Cross-Site Request Forgery) state value on the localhost callback. While the CLI awaits authentication, a malicious web page can send a request to the local callback server using an attacker-controlled token. If this request is processed before the legitimate callback, the CLI may complete the login process using incorrect credentials. This issue specifically affects users authenticating the turbo CLI against self-hosted remote cache or authentication endpoints.

Recommendations Update to version 2.9.14.

Exploit

Fix

CSRF

Session Fixation

Weakness Enumeration

CWE-352

CWE-384

Related Identifiers

CVE-2026-45773

GHSA-HCF7-66RW-9F5R

Affected Products

Turborepo

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45773.json · Exploit
• https://github.com/vercel/turborepo/security/advisories/GHSA-hcf7-66rw-9f5r · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hcf7-66rw-9f5r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-45773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45773 · Security Note
• https://github.com/vercel/turborepo · Note
• https://t.me/CVEtracker/53936 · Telegram Post