Turbo-graph can let network users run project tasks

Published September 9, 2026 CVE-2026-59160

@yeger/turbo-graph lets someone on the same network run tasks in a developer's project without logging in. Those tasks can change files, expose secrets, disrupt work, or trigger deployments.

Severity
HighCVSS 8.8
Fix
Fixed in 2.8.12Fix recorded yesterday
Affected versions
2.8.8 or older
Affects
@yeger/turbo-graph

How it works

  • The server listens on all network interfaces, making it reachable from the local network.
  • Its /api/run endpoint accepts task requests without authentication or an approved-task check.
  • The selected Turborepo task runs with the developer's operating-system permissions.

What to do

Run npm list @yeger/turbo-graph in each project that runs turbo-graph. Versions 2.8.8 and earlier are affected.

Run this in the application environment you want to check:

npm list @yeger/turbo-graph

Update @yeger/turbo-graph to version 2.8.12 using the project's normal npm update process. Confirm that each affected project reports version 2.8.12.

Technical details

CVE-2026-59160 combines network exposure with missing access controls on /api/run. An adjacent-network attacker can select tasks defined in the repository, and those tasks run with the developer's operating-system permissions.

References

View Original Source