Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

vercel/turborepo

              main @ 417c28d
            

Fixes

CVEs

CRITICAL

Peak severity

23.5%

Coverage

Highlights

Denial of Service: 32 prior fixes. Scrutinize any change in this area.

crates/turborepo-auth: most-fixed (6 issues). Treat as high-risk during review.

35 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Attackers can trigger remote code execution when turbo commands are run inside untrusted workspaces by loading malicious yarnPath configurations or executing repository-controlled scripts during package version discovery. This has been a critical vector for supply chain compromise.

Command Injection: Shell-interpreting execution utilities like child_process.execSync were frequently used with user-provided or repository-defined inputs without proper escaping, allowing arbitrary command execution during automated workspace workflows.

Path Traversal: Malicious symlinks planted in archives or workspace structures can bypass simple lexical checks, resulting in files being written outside the repository root or reading sensitive files during cache compilation and restoration.