Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run (CVE-2026-59160) | HOL Guard CVE

High · CVSS 8.8CVE-2026-59160GHSA-2R5Q-H53F-9RP3

Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run

Answer in brief

CVE-2026-59160 records a High severity (CVSS 8.8) vulnerability in Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run. The current sources do not mark it as known exploited. The current feed maps DerYeger/yeger (generic), @yeger/turbo-graph (npm), @yeger/turbo-graph (npm). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 15, 2026Updated Sep 15, 2026Source checked Sep 16, 2026First seen by HOL Sep 9, 2026Material review Sep 15, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 8.8
Exploitation: Not marked as known exploited
Affected software: 3 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps DerYeger/yeger (generic), @yeger/turbo-graph (npm), @yeger/turbo-graph (npm). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
DerYeger/yegergeneric	< 2.8.9	Not reported
@yeger/turbo-graphnpm	<=2.8.8	2.8.12
@yeger/turbo-graphnpm	>=0 <2.8.12	2.8.12

Recommended response

Check inventory. Check lockfiles and deployed manifests for DerYeger/yeger, @yeger/turbo-graph, @yeger/turbo-graph.
Review the reported fix. Update @yeger/turbo-graph to 2.8.12; @yeger/turbo-graph to 2.8.12 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 9, 2026

Sources and claim methodology

Upstream source description

Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages/turbo-graph/src/index.ts on all interfaces, including 0.0.0.0:29312 by default, while the GET handler for /api/run in packages/turbo-graph-ui/app/api/run/route.ts has no authentication, authorization, CSRF protection, or task allowlist. The handler accepts the tasks, filter, and force query parameters, and buildResponseFromArgs passes attacker-selected task names to spawn() as Turbo CLI arguments. An adjacent-network attacker can execute any task defined in the victim repository's turbo.json with the privileges of the developer OS user, potentially exposing secrets, modifying files or infrastructure, or causing destructive availability effects. The use of an argument array prevents traditional shell metacharacter injection but does not prevent unauthorized execution of defined tasks. This issue is fixed in version 2.8.9.

Quoted source text, attributed separately from HOL analysis.