Turborepo LSP CVE-2026-46508

User must have the Turborepo LSP VS Code extension installed (versions before 2.9.14000) and open a malicious workspace that contains crafted task names or workspace settings with shell injection payloads. The vulnerability triggers either when the extension activates upon opening the workspace or when the user manually runs a task through the extension interface. Exploitation is limited by the requirement for user interaction and local workspace access.

The CVSS 4.0 vector indicates local attack vector (AV:L) with low complexity (AC:L), no privileges required (PR:N), but user interaction needed (UI:A), resulting in high impact across confidentiality, integrity, and availability. The 8.4 score reflects the severity of arbitrary command execution, though exploitation requires a user to open a malicious workspace in VS Code. No EPSS score or CISA KEV listing is provided, suggesting this is not currently under active exploitation. The local vector and user interaction requirement significantly reduce the likelihood of mass exploitation compared to remote vulnerabilities.

An attacker creates a malicious repository with crafted task names or workspace settings containing shell metacharacters. When a developer clones this repository and opens it in VS Code with the vulnerable Turborepo extension installed, the extension activates and processes the malicious values, executing the injected commands with the user's privileges.