CVE-2026-59160

@yeger/turbo-graph, an npm package for visualizing Turborepo task graphs, starts an embedded Next.js server bound to all network interfaces (0.0.0.0:29312 by default) instead of the loopback interface, because the declared 'localhost' hostname is never passed to Node's listen() call. Its /api/run GET endpoint performs no authentication, session validation, CSRF protection, or task allowlist check (CWE-306) and passes attacker-supplied 'tasks' and 'filter' query parameters directly into a spawn() of the Turbo CLI. An unauthenticated adjacent-network attacker can therefore send a crafted GET request to the /api/run endpoint to trigger arbitrary repository-defined Turborepo tasks, gaining code execution, file modification, destructive build side effects, or deployment of attacker-chosen targets with the privileges of the developer's OS user. Anyone running the @yeger/turbo-graph dev server, typically on a developer workstation while inspecting a monorepo, is affected; no affected version range or fixed version is specified in the available data. No public proof-of-concept or in-the-wild exploitation is known; the flaw carries a CVSS 3.1 score of 8.8 (high) with an adjacent-network attack vector.

What to do: Upgrade @yeger/turbo-graph to the latest patched release when one is published (no fixed version is stated in the available data) and check your dependency tree with npm ls @yeger/turbo-graph. Until patched, restrict inbound access to TCP port 29312 with a host firewall so only the local machine can reach /api/run, run the tool only on trusted networks, and stop the dev server when it is not in use. Also review recent task runs and deployments in affected repositories for signs of unauthenticated triggering.