Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

yeoman-environment

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.6npmAmendedPublished

    yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

    CVE-2026-42089 · GHSA-vv9j-gjw2-j8wp

    Affected
    • npm yeoman-environment >= 2.9.0, < 6.0.1
    Fixed in
    6.0.1· Vendor fix available
    Issue
    Impact yeoman-environment versions = 2.9.0 and < 6.0.1 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap. The vulnerable method is installLocalGenerators(), which calls repository.install() directly without prompting the user. Patches Upgrade to yeoman-environment 6.0.1, which adds an interactive confirmation prompt before installation (PR #753). Workarounds None. Resources - Fix commit 78d2af7

    Recommended action: Upgrade to 6.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →