CVE-2026-42089
Description
A flaw was found in Yeoman Environment. This vulnerability allows an attacker to install arbitrary packages and execute code during command-line interface (CLI) bootstrap. This occurs because the software installs missing local generator packages from caller-supplied names without user confirmation, particularly when downstream consumers pass attacker-controlled project configurations. The primary impact is arbitrary code execution.
Statement
This is an Important flaw in Yeoman Environment that could lead to arbitrary code execution. The vulnerability arises when downstream consumers process attacker-controlled project configurations, allowing the installation of unconfirmed local generator packages during CLI bootstrap. Exploitation requires user interaction with malicious input, limiting the attack vector to specific development workflows.
Mitigation
To mitigate this issue, users should avoid processing project configurations from untrusted sources with Yeoman Environment. Ensure that all project configurations and generator package names are from trusted origins to prevent the installation of arbitrary packages and subsequent code execution.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability,Access Control
Technical Impact: Gain Privileges or Assume Identity; Execute Unauthorized Code or Commands
There is the potential for arbitrary code execution with privileges of the vulnerable program.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The program could be redirected to the wrong files, potentially triggering a crash or hang when the targeted file is too large or does not have the expected format.
Confidentiality
Technical Impact: Read Files or Directories
The program could send the output of unauthorized files to the attacker.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
