PT-2026-43442 · Git+2 · Environment+1

CVE-2026-42089 · Published 2026-05-26 · Updated 2026-06-16

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yeoman Environment versions 2.9.0 through 6.0.0

Description Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. The installLocalGenerators() function calls repository.install() directly without prompting the user, allowing the installation of missing local generator packages from caller-supplied package names without confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can lead to arbitrary package installation and code execution during CLI bootstrap.

Recommendations Update to version 6.0.1.

Exploit

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-42089

GHSA-VV9J-GJW2-J8WP

Affected Products

Environment

Yeoman-Environment

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42089.json · Exploit
• https://osv.dev/vulnerability/GHSA-vv9j-gjw2-j8wp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42089 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42089 · Security Note
• https://github.com/yeoman/environment · Note
• https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b6a1fa · Note
• https://github.com/yeoman/environment/security/advisories/GHSA-vv9j-gjw2-j8wp · Note
• https://github.com/yeoman/environment/pull/753 · Note
• https://reddit.com/r/cybersecurity/comments/1tp3ycb/12_npmpypisupplychain_threats_today_20260527 · Reddit Post
• https://t.me/CVEtracker/57020 · Telegram Post
• https://twitter.com/CVEnew/status/2066980888483954809 · Twitter Post