Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-42089: Yeoman Environment Vulnerable to Malicious Package Installation

CVE-2026-42089 · published 4 months ago

Summary

Versions of Yeoman Environment (2.9.0 to 6.0.1) can install packages without user approval, potentially allowing attackers to execute code. To fix this, update to version 6.0.1, which adds a confirmation prompt. No temporary workarounds are available, so an update is necessary.

What to do

Update GitHub Actions yeoman-environment to version 6.0.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	GitHub Actions	yeoman-environment	>= 2.9.0, < 6.0.1 Fix: upgrade to 6.0.1

Original advisory text

yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap. The vulnerable method is installLocalGenerators(), which calls repository.install() directly without prompting the user. This issue has been fixed in version 6.0.0.

References

https://github.com/advisories/GHSA-vv9j-gjw2-j8wp
https://github.com/yeoman/environment/security/advisories/GHSA-vv9j-gjw2-j8wp Vendor Advisory
https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b... Patch
https://github.com/yeoman/environment/pull/753 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42089... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42089 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.6 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-829Inclusion of Functionality from Untrusted Control Sphere

Timeline

Published16 Jun 2026

Updated27 Oct 2026

First seen26 May 2026

Sources

GHSA-vv9j-gjw2-j8wp · GHSA

CVE-2026-42089 · NVD

CVE-2026-42089 · OSV

Track software like this

Free during beta