turbo

Turborepo is the build system for coding agents.

Latest 2.11.8

NPM

86%

Total Score

healthy

Active maintenance, release provenance, and strong project backing outweigh contained workflow hygiene concerns.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 12 workflows were analyzed with no untrusted checkout or script-injection counts, and 11 use read-only permissions. High-confidence template-injection, secrets-inherit, and adhoc-packages findings, plus a trusted-publishing finding, are workflow hygiene and credential-management cautions; the sole top-level-write workflow has no reported untrusted checkout sink.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-427079 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. turbo is vulnerable to Path Traversal in versions 1.0.0 - 2.9.17.	1.0.0 - 2.9.17	Low
AIKIDO-2026-10952 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. turbo is vulnerable to Race Condition (TOCTOU) in versions 0.0.1 - 2.9.14.	0.0.1 - 2.9.14	Medium
CVE-2026-45773 turbo is vulnerable to Cross-Site Request Forgery (CSRF) in versions 0.0.0 - 2.9.13.	0.0.0 - 2.9.13	Medium
CVE-2026-45772 turbo is vulnerable to Untrusted Search Path in versions 1.1.0 - 2.9.14.	1.1.0 - 2.9.14	Critical