vercel/turborepo · error · Error

Directory path contains potentially unsafe characters

Error message

Directory path contains potentially unsafe characters: ${dir}

What it means

Before create-turbo runs git commands in your new project, it validates the install path against shell metacharacters. This Error is thrown when the directory contains any of backtick, dollar, parentheses, braces, pipe, semicolon, ampersand, angle brackets, exclamation mark, or hash. The guard prevents command injection through user-supplied paths passed as cwd to git.

Solutions

Rename the target directory so it uses only letters, digits, dash, underscore, and dot
Re-run create-turbo and answer the project name and install path prompts without #, $, parentheses, or other special characters
If you need that exact path later, scaffold into a safe name first, then rename after create-turbo finishes

Example fix

# before: path with metacharacters
npx create-turbo@latest "my-app(v2)"
# after: safe path
npx create-turbo@latest my-app-v2

Defensive patterns

Strategy: validation

Validate before calling

const UNSAFE = /[`$(){}|;&<>!#]/;

// reject unsafe names before they reach create-turbo prompts or scripts
function isSafeDirectoryPath(dir: string): boolean {
  return !UNSAFE.test(dir);
}

if (!isSafeDirectoryPath(projectDir)) {
  throw new Error("Project path may only contain letters, digits, dash, underscore, dot");
}

Type guard

function isSafeDirectoryName(name: string): boolean {
  return !/[`$(){}|;&<>!#]/.test(name);
}

Prevention

Restrict project names to letters, digits, dash, underscore, and dot
Validate CI workspace paths with the same character rule
Never embed branch names, issue tags, or shell syntax into directory names

When it happens

Trigger: The project name or install path you gave create-turbo contains a character matched by /[`$(){}|;&<>!#]/. Examples: my$app, demo(1), a;b, team#proj. tryGitInit calls assertSafeDirectory with the root path and the check fails before any git command runs.

Common situations: Naming a project after a branch or issue that contains #, such as feat#123. Using parentheses in versioned folder names like app(2). CI workspaces created under paths with special characters. Copy-paste paths that include shell syntax.

Related errors

AI-assisted analysis of vercel/turborepo@f9245100cf (2026-08-17). Data as JSON: /api/errors/d6f6a6f1e6c25946. Report an issue: GitHub.

Appendix: source

Thrown at packages/create-turbo/src/utils/git.ts:36

*.pem

# debug
npm-debug.log*
yarn-debug.log*
yarn-error.log*

# turbo
.turbo

# vercel
.vercel
`;

const SHELL_METACHARACTERS = /[`$(){}|;&<>!#]/;

function assertSafeDirectory(dir: string): void {
  if (SHELL_METACHARACTERS.test(dir)) {
    throw new Error(
      `Directory path contains potentially unsafe characters: ${dir}`
    );
  }
}

function git(args: Array<string>, cwd: string): boolean {
  const result = spawnSync("git", args, { stdio: "ignore", cwd });
  if (result.status !== 0) {
    throw new Error(`git ${args[0]} failed`);
  }
  return true;
}

function isInGitRepository(root: string): boolean {
  try {
    git(["rev-parse", "--is-inside-work-tree"], root);
    return true;
  } catch (_) {

View on GitHub (pinned to f9245100cf)