CVE-2026-59160
Received Received - Intake

Unauthenticated Remote Code Execution in Yeger Turbo-Graph

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages/turbo-graph/src/index.ts on all interfaces, including 0.0.0.0:29312 by default, while the GET handler for /api/run in packages/turbo-graph-ui/app/api/run/route.ts has no authentication, authorization, CSRF protection, or task allowlist. The handler accepts the tasks, filter, and force query parameters, and buildResponseFromArgs passes attacker-selected task names to spawn() as Turbo CLI arguments. An adjacent-network attacker can execute any task defined in the victim repository's turbo.json with the privileges of the developer OS user, potentially exposing secrets, modifying files or infrastructure, or causing destructive availability effects. The use of an argument array prevents traditional shell metacharacter injection but does not prevent unauthorized execution of defined tasks. This issue is fixed in version 2.8.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-59160
EUVD
EUVD-2026-78834

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
yeger turbo-graph 2.8.9
yeger turbo-graph to 2.8.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the turbo-graph package of the Yeger monorepo. The package starts a Next.js server on all network interfaces by default, including a specific port. The server's API endpoint lacks authentication, authorization, and CSRF protection. An attacker on the same network can send malicious requests to execute any task defined in the victim's turbo.json file with the privileges of the developer's operating system user. This could lead to unauthorized code execution, data exposure, or system damage.

Detection Guidance

Check if the turbo-graph server is running on port 29312 by using commands like 'netstat -tulnp | grep 29312' or 'ss -tulnp | grep 29312'. Inspect the process running on this port with 'ps aux | grep turbo-graph' to confirm if it is the vulnerable version.

Impact Analysis

If you use the affected version of turbo-graph, an attacker on your local network could exploit this to run arbitrary tasks defined in your project's turbo.json. This may allow them to access sensitive data, modify files, alter infrastructure, or disrupt services running on your machine. The impact depends on the tasks defined in your turbo.json and the permissions of your user account.

Mitigation Strategies

Upgrade to version 2.8.9 or later of the turbo-graph package to address the vulnerability. If upgrading is not immediately possible, restrict network access to the server running on port 29312 using firewalls or network policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59160. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart