CVE-2026-59160

creationtimestamp| type| source ---|---|--- 2026-09-10 00:35:15+00:00| published-proof-of-concept| https://github.com/DerYeger/yeger/security/advisories/GHSA-2r5q-h53f-9rp3 2026-09-10 04:01:24+00:00| seen| https://gist.github.com/ichintu/d78ea836a25ff89ea1b8a699d08a5b4d...

GHSA-2R5Q-H53F-9RP3 @yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...