https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 12:45:02 +0000 https://cve.radiocsirt.org/vuln/cve-2026-46508 <p><strong>Affected:</strong> vercel turborepo</p> <p>Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute shell commands derived from workspace-controlled values. The extension used string-based command execution for Turborepo daemon commands and task runs. A malicious workspace could provide crafted values through workspace settings or task names in the repository&#39;s source code that were interpolated into shell commands. When the extension activated or when a user ran a task through the extension, those values could be interpreted by the user&#39;s shell, allowing arbitrary command execution with the privileges of the local VS Code process. This vulnerability is fixed in 2.9.14000.</p> <p><strong>Affected:</strong> vercel turborepo</p> <p>Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute shell commands derived from workspace-controlled values. The extension used string-based command execution for Turborepo daemon commands and task runs. A malicious workspace could provide crafted values through workspace settings or task names in the repository&#39;s source code that were interpolated into shell commands. When the extension activated or when a user ran a task through the extension, those values could be interpreted by the user&#39;s shell, allowing arbitrary command execution with the privileges of the local VS Code process. This vulnerability is fixed in 2.9.14000.</p> https://cve.radiocsirt.org/vuln/cve-2026-46508