Vendor
The @yeger/turbo-graph package exposes an unauthenticated HTTP endpoint (/api/run) that binds to all network interfaces, allowing adjacent attackers to execute arbitrary Turborepo tasks defined in the victim repository.