{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/yeger/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["turbo-graph (2.8.8)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","nodejs","insecure-api"],"_cs_type":"advisory","_cs_vendors":["yeger"],"content_html":"\u003cp\u003eThe \u003ccode\u003e@yeger/turbo-graph\u003c/code\u003e package (specifically version 2.8.8) contains a critical vulnerability due to insecure default configuration and the absence of authentication on its administrative API. The application's embedded Next.js server fails to bind to the local loopback interface (localhost), defaulting instead to \u003ccode\u003e0.0.0.0\u003c/code\u003e and \u003ccode\u003e::\u003c/code\u003e. This exposes the service to the entire network segment.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003e/api/run\u003c/code\u003e endpoint is designed to trigger Turborepo tasks; however, it lacks any authentication, authorization, CSRF protections, or task allowlisting. An adjacent attacker can send a simple GET request containing the name of any task defined in the victim's \u003ccode\u003eturbo.json\u003c/code\u003e file. The server then uses \u003ccode\u003espawn()\u003c/code\u003e to execute these tasks with the privileges of the developer's operating system user. This allows attackers to perform malicious actions including sensitive data exfiltration, file modification, or unauthorized infrastructure deployment depending on the tasks configured within the target repository.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe victim starts the \u003ccode\u003eturbo-graph\u003c/code\u003e development utility in a repository that contains a \u003ccode\u003eturbo.json\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eThe application's Node.js \u003ccode\u003elisten()\u003c/code\u003e call executes without a hostname constraint, causing the server to bind to all network interfaces (e.g., \u003ccode\u003e0.0.0.0:29312\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker performs network reconnaissance to identify active services on port \u003ccode\u003e29312\u003c/code\u003e within the local network segment.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP GET request to the \u003ccode\u003e/api/run\u003c/code\u003e endpoint, supplying the target task name via the \u003ccode\u003etasks\u003c/code\u003e query parameter.\u003c/li\u003e\n\u003cli\u003eThe server receives the unauthenticated request and immediately passes the user-supplied task argument to the \u003ccode\u003ebuildResponseFromArgs\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ebuildResponseFromArgs\u003c/code\u003e function constructs a \u003ccode\u003eturbo\u003c/code\u003e CLI argument array and calls \u003ccode\u003espawn()\u003c/code\u003e to execute the specified task.\u003c/li\u003e\n\u003cli\u003eThe operating system executes the requested task script (defined in the \u003ccode\u003epackage.json\u003c/code\u003e scripts) under the context of the victim's user session, completing the RCE objective.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a high risk to development environments where \u003ccode\u003eturbo-graph\u003c/code\u003e is utilized. Because it requires no credentials and targets a default static port, internal lateral movement or network-adjacent exploitation is highly trivial. Successful exploitation results in full remote code execution in the context of the developer, potentially leading to the theft of environment variables, SSH keys, cloud credentials, or persistent compromise of the developer's workstation and internal build infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the immediate decommissioning of \u003ccode\u003e@yeger/turbo-graph\u003c/code\u003e version 2.8.8 until an official patch is applied or binding behavior is corrected.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify any instances of \u003ccode\u003eturbo-graph\u003c/code\u003e listening on non-loopback interfaces using host-level process monitoring or network auditing.\u003c/li\u003e\n\u003cli\u003eRestrict network access to port \u003ccode\u003e29312\u003c/code\u003e via host-based firewalls (e.g., \u003ccode\u003eiptables\u003c/code\u003e, \u003ccode\u003enftables\u003c/code\u003e, or Windows Firewall) to ensure only local traffic can reach the service.\u003c/li\u003e\n\u003cli\u003eMonitor for unusual process spawns originating from the \u003ccode\u003eturbo-graph\u003c/code\u003e process (or its parent process) that correlate with inbound network connections to the development port.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-10T00:51:37Z","date_published":"2026-09-10T00:51:37Z","id":"https://feed.craftedsignal.io/briefs/2026-09-turbo-graph-rce/","summary":"The @yeger/turbo-graph package exposes an unauthenticated HTTP endpoint (/api/run) that binds to all network interfaces, allowing adjacent attackers to execute arbitrary Turborepo tasks defined in the victim repository.","title":"Unauthenticated Remote Task Execution in @yeger/turbo-graph","url":"https://feed.craftedsignal.io/briefs/2026-09-turbo-graph-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Yeger","version":"https://jsonfeed.org/version/1.1"}