AIKIDO-2026-10957

TL;DR

Turborepo cache archive and restore logic follows symlinks and is vulnerable to time-of-check/time-of-use races when restoring cached task outputs or writing structured logs. A local attacker who can plant or swap symlinks in the workspace during a run can redirect file reads and writes outside the intended output directory. Experimental OpenTelemetry export also accepted HTTPS endpoints targeting private networks and cloud metadata hosts. The fix uses no-follow opens, race-safe path validation, directory modes only at creation time, and rejects unsafe OTEL endpoint hosts.