CVE-2026-46508— Turborepo: VSCode Extension command injection
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-46508
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Turborepo: VSCode Extension command injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute shell commands derived from workspace-controlled values. The extension used string-based command execution for Turborepo daemon commands and task runs. A malicious workspace could provide crafted values through workspace settings or task names in the repository's source code that were interpolated into shell commands. When the extension activated or when a user ran a task through the extension, those values could be interpreted by the user's shell, allowing arbitrary command execution with the privileges of the local VS Code process. This vulnerability is fixed in 2.9.14000.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-46508
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-46508
请登录查看更多情报信息。
- https://github.com/vercel/turborepo/security/advisories/GHSA-5xc8-49mv-x4mmx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-46508
Same Patch Batch · vercel · 2026-05-15 · 3 CVEs total
| CVE-2026-45772 | Turborepo: Unexpected local code execution during Yarn Berry detection | |
| CVE-2026-45773 | Turborepo: Login callback CSRF/session fixation |
IV. Related Vulnerabilities
Same vendor: vercel
- CVE-2026-45773
Turborepo: Login callback CSRF/session fixation - CVE-2026-45772
Turborepo: Unexpected local code execution during Yarn Berry - CVE-2026-45109
Next.js: Middleware / Proxy bypass in App Router application - CVE-2026-44582
Next.js: Cache poisoning via collisions in React Server Comp - CVE-2026-44581
Next.js: Cross-site scripting in App Router applications usi
V. Comments for CVE-2026-46508
No comments yet