Vulnerability · Published Jun 16, 2026 · Assigned by GitHub_M

CVE-2026-42089yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

High 8.6

In plain English

A high-severity security flaw in environment from yeoman. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.2%top 93.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap. The vulnerable method is installLocalGenerators(), which calls repository.install() directly without prompting the user. This issue has been fixed in version 6.0.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	yeoman-environment	6.0.1	GHSA-vv9j-gjw2-j8wp

Affected products (as reported)

Vendor	Product	Versions
yeoman	environment	>= 2.9.0, < 6.0.1

Weakness: CWE-829 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/yeoman/environment/security/advisories/GHSA-vv9j-gjw2-j8wp x_refsource_CONFIRM
https://github.com/yeoman/environment/pull/753 x_refsource_MISC
https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b6a1fa x_refsource_MISC