AIKIDO-2026-10952

TL;DR

The Turborepo CLI caches and restores task outputs on the local filesystem. Before the fix, symlink and reparse-point races during cache archiving, restore, structured log creation, and directory permission updates could follow attacker-controlled links and read or write files outside the intended cache workspace. A malicious repository layout or concurrent filesystem changes during CI could exploit these gaps to corrupt or read host files, and permissive experimental OpenTelemetry endpoint settings could reach internal or cloud metadata hosts. The fix enforces no-follow handle validation on cache and log paths, closes restore race windows, applies directory modes safely, and rejects unsafe OTEL endpoint hosts.