GitHub Advisoryadvisory · npm

GHSA-vv9j-gjw2-j8wp yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

HIGH Published 2026-05-26 Modified 2026-07-08 Official page ↗
Aliases
CVE-2026-42089
Ecosystem
npm
Packages
yeoman-environment
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-829
Reviewed
2026-05-26

Affected packages

• npm yeoman-environment: >= 2.9.0, < 6.0.1 → fixed in 6.0.1

Description

Impact `yeoman-environment` versions `>= 2.9.0` and `< 6.0.1` install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap. The vulnerable method is `installLocalGenerators()`, which calls `repository.install()` directly without prompting the user. Patches Upgrade to `yeoman-environment` `6.0.1`, which adds an interactive confirmation prompt before installation (PR #753). Workarounds None. Resources • Fix commit 78d2af7

Related

Alias · CVE (1)

  • CVE-2026-42089 Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. vulnerability

Weakness · CWE (1)

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

References