Turborepo 2.9.14 patches VS Code extension command injection.

{
  "signal_id": "247f0118-a117-4df6-bfec-e8d2e078ec63",
  "signal_type": "news",
  "signal_subtype": "launches",
  "detected_at": "2026-05-14T12:00:00+00:00",
  "company": {
    "name": "Vercel",
    "domain": "vercel.com"
  },
  "data": {
    "url": "https://www.osbytes.io/blog/turborepo-2-9-14-patches-vs-code-extension-command-injection",
    "title": "Turborepo 2.9.14 patches VS Code extension command injection.",
    "excerpt": "Turborepo 2.9.14 patches VS Code extension command injection.\n\nVercel shipped Turborepo v2.9.14 today. Under the CI and docs churn sits a blunt security note worth catching even if your monorepo never touches turbo on the CLI: the VS Code Turborepo / LSP extension carries fixes for multiple advisories, and the headline item is GHSA-5xc8-49mv-x4mm (CVE-2026-46508, rated High).\n\nWhere the hole actually lived.\n\nUpstream's wording is sober. Older extension builds routed some daemon and task-runner work through string-shaped shell commands. Values that a repo can steer (workspace configuration, names of tasks surfaced from the codebase) fed into those strings. Activate the extension against a hostile clone, or run a task through the extension UI after those values loaded, and the host shell could interpret the payload as arbitrary commands running with whatever rights the VS Code process already has.\n\nThis is classic \"IDE extension meets untrusted workspace\" territory. The precondition is simpler than chasing a zero-day broker: convincing someone to open your repo locally plus enough interaction that the extension does its job.\n\nWhat changed in practical terms.\n\nGitHub lists the patched band as >= 2.9.14000 for the Turborepo LSP package and summarizes the remediation as ditching brittle shell interpolation (execFile with explicit argv for daemon hooks, structured terminal launches...",
    "product": "Turborepo v2.9.14",
    "summary": "Vercel Inc. launches Turborepo v2.9.14.",
    "planning": false,
    "image_url": "https://www.osbytes.io/blog/turborepo-2-9-14-patches-vs-code-extension-command-injection/opengraph-image?85e173741555b7b1",
    "confidence": 0.3858,
    "product_data": {
      "full_text": "Turborepo v2.9.14",
      "fuzzy_match": true
    },
    "published_at": "2026-05-14T12:00:00Z",
    "article_sentence": "Vercel shipped Turborepo v2.9.14 today."
  }
}

curl https://signals.autobound.ai/v1/signals/247f0118-a117-4df6-bfec-e8d2e078ec63 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"vercel.com","limit":20}'