{"action":"Upgrade @yeger/turbo-graph to 2.8.12 or later.","affected":[{"fixed":"2.8.12","introduced":"0"}],"component":"@yeger/turbo-graph","cve_ids":["CVE-2026-59160"],"ecosystem":"npm","epss":0.00487,"exploited":false,"fixed_versions":["2.8.12"],"ghsa_id":"GHSA-2r5q-h53f-9rp3","id":"tcs_01M5KETYNJ15BW6D9EDSMVJ682","modified_at":"2026-09-10T00:10:57.740455Z","published_at":"2026-09-09T23:47:55Z","references":["https://osv.dev/vulnerability/GHSA-2r5q-h53f-9rp3","https://github.com/DerYeger/yeger/security/advisories/GHSA-2r5q-h53f-9rp3","https://github.com/DerYeger/yeger"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-2r5q-h53f-9rp3","url":"https://osv.dev/vulnerability/GHSA-2r5q-h53f-9rp3"}],"summary":"@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run"}