CVE-2026-42089 yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation
Attackers can trigger arbitrary package installation and code execution by supplying malicious generator names to the Yeoman environment library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42089?
CVE-2026-42089 is a high-severity code injection vulnerability in yeoman environment, published on 16 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap. The vulnerable method is installLocalGenerators(), which calls repository.install() directly without prompting the user. This issue has been fixed in version 6.0.0.
Weakness: CWE-829
Which versions are affected by CVE-2026-42089?
2 open source packages ship an affected version, including yeoman-environment.
| Package | Affected | Fixed in |
|---|---|---|
yeoman-environment npm | From 2.9.0 | 6.0.1 |
yeoman-environment npm | From 2.9.0 | 6.0.1 |
How do I fix CVE-2026-42089?
Upgrade yeoman-environment to 6.0.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-42089 being exploited?
There is no known exploitation of CVE-2026-42089 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as CLSA-2026-1789069708, GHSA-vv9j-gjw2-j8wp.