CVE-2026-42089 Details
Description
Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap. The vulnerable method is installLocalGenerators(), which calls repository.install() directly without prompting the user. This issue has been fixed in version 6.0.0.
A vulnerability in Yeoman Environment versions 2.9.0 prior to 6.0.1 allows for arbitrary package installation without user confirmation. The issue arises in the 'installLocalGenerators()' method, which directly calls 'repository.install()' without prompting the user. This vulnerability can be exploited in downstream consumers that pass attacker-controlled project configuration, leading to unauthorized package installation and potential code execution during command-line interface (CLI) bootstrap.
Upgrade to Yeoman Environment version 6.0.1 or later, which includes a confirmation prompt before installing local packages.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 16, 2026CISA-ADP
Assessed Jun 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b6a1fa | [email protected] | Source CodeVendor |
| https://github.com/yeoman/environment/pull/753 | [email protected] | Issue TrackingVendor |
| https://github.com/yeoman/environment/security/advisories/GHSA-vv9j-gjw2-j8wp | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Yeoman Environment | >= 2.9.0, < 6.0.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | New CVE Received | [email protected] |