CVE-2026-59160: Yeger turbo-graph RCE Vulnerability

CVE-2026-59160 Overview

CVE-2026-59160 is a missing authentication vulnerability [CWE-306] in the @yeger/turbo-graph npm package, part of the Yeger monorepo. Versions prior to 2.8.9 start an embedded Next.js server that binds to all network interfaces (0.0.0.0:29312) by default. The GET /api/run handler in packages/turbo-graph-ui/app/api/run/route.ts lacks authentication, authorization, Cross-Site Request Forgery (CSRF) protection, and any task allowlist.

An adjacent-network attacker can invoke any task defined in the victim repository's turbo.json with developer OS privileges. This can expose secrets, modify files or infrastructure, and cause destructive availability effects. The issue is fixed in version 2.8.9.

Critical Impact
Any attacker on the same local network can execute arbitrary Turbo tasks with developer privileges, potentially compromising source code, credentials, and connected infrastructure.

Affected Products

@yeger/turbo-graph package versions prior to 2.8.9
Yeger monorepo (npm packages under the yeger scope)
Developer workstations running the embedded Next.js server on port 29312

Discovery Timeline

2026-09-15 - CVE-2026-59160 published to NVD
2026-09-15 - Last updated in NVD database
Version 2.8.9 - Fix released via GitHub Release @yeger/turbo-graph

Technical Details for CVE-2026-59160

Vulnerability Analysis

The turbo-graph package launches an embedded Next.js server from packages/turbo-graph/src/index.ts. The server binds to 0.0.0.0:29312, making it reachable from any host on the adjacent network segment. The GET route at /api/run accepts three query parameters: tasks, filter, and force.

The buildResponseFromArgs function forwards the attacker-supplied tasks values directly to spawn() as Turbo CLI arguments. Because arguments are passed as an array rather than through a shell, traditional shell metacharacter injection is blocked. However, the absence of an allowlist means any valid task defined in turbo.json can be executed by an unauthenticated remote caller.

Root Cause

The root cause is missing authentication [CWE-306] on a privileged HTTP endpoint combined with an unnecessarily broad network binding. The handler assumes trusted local usage but exposes the interface to the entire adjacent network. No CSRF token, session check, or task allowlist gates the invocation.

Attack Vector

An attacker on the same Wi-Fi or LAN segment as a developer running turbo-graph issues a crafted HTTP GET request to http://<developer-ip>:29312/api/run?tasks=<task>. The server spawns the specified Turbo task under the developer's OS user, granting the attacker execution of scripts such as build, deploy, publish, or test defined in the target repository.

typescript

// Security patch in packages/turbo-graph/src/index.ts
// fix(turbo-graph): only listen on localhost

  cli.parse()

  function startServer(tasks: string[], options: Options) {
-    const app = next({ dev: false, dir: source, port: options.port })
+    const app = next({ dev: false, dir: source, hostname, port: options.port })
    const handle = app.getRequestHandler()

    void app.prepare().then(() => {

Source: GitHub Commit a6c41db. The patch restricts the Next.js server to a specific hostname, defaulting to localhost instead of all interfaces.

Detection Methods for CVE-2026-59160

Indicators of Compromise

Unexpected process spawns of turbo or npx turbo run <task> originating from the turbo-graph Next.js process
Inbound TCP connections to port 29312 from non-loopback source addresses
HTTP access log entries for /api/run containing tasks, filter, or force query parameters from remote IPs
Unscheduled execution of build, deploy, or publish scripts on developer workstations

Detection Strategies

Inspect developer endpoint telemetry for node or next-server processes listening on 0.0.0.0:29312
Correlate child-process events from the turbo-graph server with subsequent spawn() invocations of Turbo CLI
Alert on outbound network egress or filesystem changes that follow inbound requests to port 29312

Monitoring Recommendations

Enable host firewall logging for connections to port 29312 and flag any non-localhost source
Track installed versions of @yeger/turbo-graph across developer machines and flag versions below 2.8.9
Monitor CI/CD and repository logs for unexpected task executions triggered outside normal developer workflows

How to Mitigate CVE-2026-59160

Immediate Actions Required

Upgrade @yeger/turbo-graph to version 2.8.9 or later on all developer workstations
Terminate any running turbo-graph server instances until the upgrade is applied
Restrict the developer network segment and block inbound traffic to TCP port 29312 at host and perimeter firewalls
Review turbo.json files for high-impact tasks and audit recent task executions for signs of abuse

Patch Information

The fix is available in @yeger/turbo-graph@2.8.9. See the GitHub Security Advisory GHSA-2r5q-h53f-9rp3 and the GitHub Release @yeger/turbo-graph 2.8.9. The patch binds the embedded Next.js server to a configurable hostname that defaults to localhost, eliminating adjacent-network exposure.

Workarounds

Bind the server explicitly to 127.0.0.1 by supplying a hostname flag when launching turbo-graph
Use host-based firewall rules to block all non-loopback traffic to port 29312
Run turbo-graph only on trusted, isolated networks and stop the service when not in active use

bash

# Configuration example: restrict turbo-graph to localhost and block port 29312

# Upgrade to the patched release
npm install @yeger/turbo-graph@2.8.9

# Linux host firewall rule (iptables) - drop non-loopback traffic to port 29312
sudo iptables -A INPUT -p tcp --dport 29312 ! -i lo -j DROP

# macOS packet filter equivalent
echo "block in proto tcp from any to any port 29312" | sudo pfctl -f -