AIKIDO-2025-10894

TL;DR

Affected versions of this package contain a Command Injection in turbo-ignore Git Ref Validation vulnerability, where the use of execSync with shell commands allowed user-supplied git references from environment variables to be interpreted as shell commands. The fix replaces execSync with execFileSync to ensure inputs are treated as literal arguments. An attacker could exploit this by crafting a malicious git ref value (e.g., containing ; rm -rf /) within a controlled environment variable, which would then be executed with the application's privileges when the validation script runs.