Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-59160— Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run

Quick assessment

Affected
DerYeger yeger
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Yeger 是一个在 作用域下维护的 npm 包单体仓库（monorepo）。在 2.8.9 版本之前， 包会在所有网络接口（包括默认的 ）上启动其内嵌的 Next.js 服务器（从 启动），而位于 中的 GET 请求处理器没有任何身份验证、授权、CSRF 防护或任务白名单机制。该处理器接受 、 和 查询参数，并且 函数会将攻击者选定的任务名作为 Turbo CLI 参数传递给 函数。相邻网络中的攻击者可以执行受害者仓库的 中定义的任意任务，并拥有开发者操作系统用户的权限，从而可能泄露密钥、修改文件或基础设施，或造

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59160

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run
Source: CVE Program / CVE List V5
Vulnerability Description
Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages/turbo-graph/src/index.ts on all interfaces, including 0.0.0.0:29312 by default, while the GET handler for /api/run in packages/turbo-graph-ui/app/api/run/route.ts has no authentication, authorization, CSRF protection, or task allowlist. The handler accepts the tasks, filter, and force query parameters, and buildResponseFromArgs passes attacker-selected task names to spawn() as Turbo CLI arguments. An adjacent-network attacker can execute any task defined in the victim repository's turbo.json with the privileges of the developer OS user, potentially exposing secrets, modifying files or infrastructure, or causing destructive availability effects. The use of an argument array prevents traditional shell metacharacter injection but does not prevent unauthorized execution of defined tasks. This issue is fixed in version 2.8.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
DerYeger yeger < 2.8.9 -

II. Public POCs for CVE-2026-59160

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-59160

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-59160 (1)

Vendor Advisories for CVE-2026-59160 (1)

Vendor Pages for CVE-2026-59160 (1)

IV. Related Vulnerabilities

Same weakness: CWE-306

V. Comments for CVE-2026-59160

No comments yet

Leave a comment