CVE-2026-59160: 
JavaScript vulnerability analysis and mitigation

CVE-2026-59160 is an unauthenticated remote code execution vulnerability in the npm package @yeger/turbo-graph, affecting all versions up to and including 2.8.8. The flaw causes the embedded Next.js development server to listen on all network interfaces (0.0.0.0:29312) instead of the loopback interface, and exposes an unauthenticated /api/run HTTP endpoint that executes arbitrary Turborepo tasks via spawn(). It was first published by the maintainer (DerYeger) on June 20, 2026, and added to the GitHub Advisory Database on September 9, 2026. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, DerYeger Advisory).

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) and results from two independent flaws that combine into a remotely exploitable condition. Flaw 1: In packages/turbo-graph/src/index.ts at line 44, the server calls .listen(options.port, callback) without passing a hostname argument; although const hostname = 'localhost' is declared at line 19, it is only used for constructing the console log URL and is never passed to listen(), causing Node.js to default to binding on 0.0.0.0 (all IPv4 interfaces) and :: (all IPv6 interfaces). Flaw 2: In packages/turbo-graph-ui/app/api/run/route.ts (lines 156–177), the GET() handler reads tasks, filter, and force directly from the request query string and passes them to buildResponseFromArgs, which constructs a Turbo CLI argument array and calls spawn() — with no authentication check, session validation, CSRF token, or task allowlist. Because spawn() is called with an argument array rather than a shell string, shell metacharacter injection is not applicable, but any task defined in the victim's turbo.json can be triggered without restriction (GitHub Advisory, DerYeger Advisory).

An unauthenticated attacker on the same network segment can trigger arbitrary Turborepo tasks with the full privileges of the developer's OS user account. Confidentiality impact is high — tasks that read secrets, generate build artifacts, or invoke cloud CLI commands can exfiltrate sensitive data. Integrity impact is high — tasks that write files, run database migrations, commit code, or invoke deployment scripts can permanently alter the victim's project or infrastructure. Availability impact is high — tasks that delete data, exhaust system resources, or execute destructive build steps can disrupt active development work. The default port (29312) is static and predictable, making network scanning for vulnerable hosts straightforward (GitHub Advisory).

A detailed proof-of-concept (PoC), including a Dockerfile and Python exploit script (poc.py), was published alongside the advisory and has been confirmed to reproduce the vulnerability in a containerized environment. The PoC demonstrates all three evidence points: all-interface socket binding, unauthenticated HTTP 200 response from /api/run, and creation of an arbitrary file on the victim machine. No credentials, prior access, or victim interaction are required beyond the developer having turbo-graph running. As of the advisory date, there is no evidence of in-the-wild exploitation or threat actor attribution, and the CVE is not listed in the CISA KEV catalog (GitHub Advisory, DerYeger Advisory).

1. Reconnaissance: Scan the local network segment for hosts listening on TCP port 29312 (the default turbo-graph port) using tools such as nmap -p 29312 <subnet> or masscan. The port is static and predictable.
2. Confirm vulnerability: Verify the server is bound to all interfaces by checking that the target IP (not 127.0.0.1) responds to an HTTP request: curl -I http://<victim-ip>:29312/.
3. Enumerate available tasks (optional): If the attacker has read access to the victim's repository or can infer task names, identify tasks defined in turbo.json that have desirable side effects (e.g., deploy, migrate, build, or custom scripts).
4. Send unauthenticated exploit request: Issue a plain HTTP GET request to the /api/run endpoint with the desired task name as a query parameter — no token or session cookie required:

   curl -N "http://<victim-ip>:29312/api/run?tasks=<taskname>&force=true"

5. Observe task execution: The server responds with HTTP 200 and a text/event-stream (SSE) body. An event: start message confirms the task was accepted and is running with arguments such as ["run", "<taskname>", "--ui=stream", "--force"].
6. Achieve objective: The specified Turborepo task executes in the victim's project directory with the developer's OS user privileges, enabling file creation/modification, secret exfiltration, deployment triggering, or other side effects defined in the task (GitHub Advisory, DerYeger Advisory).

• Network: Unexpected inbound TCP connections to port 29312 from hosts other than 127.0.0.1; HTTP GET requests to /api/run originating from non-localhost addresses; outbound connections from the developer workstation to unknown IPs following task execution.
• Process: Child processes spawned by the turbo-graph Node.js process that are inconsistent with normal development activity (e.g., curl, wget, sh, python, cloud CLI tools); turbo run <taskname> invocations not initiated by the developer.
• File System: Unexpected files created or modified in the project directory or /tmp/; new or altered deployment artifacts, configuration files, or scripts; presence of PoC proof files such as /tmp/turbo-graph-poc or /tmp/poc-proof.txt.
• Logs: HTTP access logs for the Next.js server showing GET requests to /api/run with tasks= query parameters from non-loopback source IPs; SSE start events in server logs with unexpected task names; Node.js process logs showing turbo run executions at unusual times (GitHub Advisory).

Upgrade @yeger/turbo-graph to version 2.8.12 or later, which is the patched release that addresses both the all-interface binding and the missing authentication on /api/run (GitHub Advisory). As an interim workaround, restrict network access to port 29312 using host-based firewall rules (e.g., iptables or ufw) to allow only 127.0.0.1 connections. Additionally, disable or avoid running turbo-graph on shared or corporate networks where adjacent-network attackers may be present. Developers who do not actively use the turbo-graph UI should remove or avoid installing the package until they can upgrade.

The vulnerability was reported by researcher min8282 (EQSTLab) and published by the maintainer DerYeger on June 20, 2026, with the GitHub Advisory Database entry updated on September 9, 2026. No significant broader media coverage or notable public social media discussion has been identified beyond the advisory itself (GitHub Advisory).