CVE-2026-42089: Yeoman environment Yeoman-environment Vulnerable To Arbitrary Package Vulnerability

HIGH
Advisory Identifier: GHSA-vv9j-gjw2-j8wp
Share
CVSS 8.6
CWE-829
Published
Advisory Summary

CVE-2026-42089 is a HIGH (CVSS 8.6) yeoman-environment vulnerable to arbitrary package vulnerability (CWE-829: Inclusion of Functionality from Untrusted Control Sphere) affecting Yeoman environment libraries in the npm ecosystem. The issue involves yeoman-environment vulnerable to arbitrary package installation without user confirmation. Remediation is available by upgrading affected packages to version 6.0.1.

CVE-2026-42089 at a Glance

CVE Identifier CVE-2026-42089
GHSA Identifier GHSA-vv9j-gjw2-j8wp
Severity HIGH
CVSS v3.1 Base Score 8.6
CWE Classification CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Affected Product Yeoman environment
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 8.6

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Changed (S:C)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-42089

To remediate this vulnerability, upgrade all affected Yeoman environment dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

yeoman-environment fixed: 6.0.1 
npm install yeoman-environment@6.0.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls yeoman-environment

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-42089, inspect your project dependencies using npm:

npm ls yeoman-environment

Analyze the terminal output to locate any version of Yeoman environment in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 6.0.1), your application is affected.

Note: The npm ls yeoman-environment command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-829: Inclusion of Functionality from Untrusted Control Sphere, where the product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. In Yeoman environment, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact `yeoman-environment` versions `>= 2.9.0` and `< 6.0.1` install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap. The vulnerable method is `installLocalGenerators()`, which calls `repository.install()` directly without prompting the user. ### Patches Upgrade to `yeoman-environment` `6.0.1`, which adds an interactive confirmation prompt before installation ([PR #753](https://github.com/yeoman/environment/pull/753)). ### Workarounds None. ### Resources - [Fix commit 78d2af7](https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b6a1fa)

CVE-2026-42089 Affected Yeoman environment Versions

1 component(s)
Fixed Versions:
6.0.1
Product / Package Ecosystem Affected Versions Fixed Version
yeoman-environment
npm/yeoman-environment
npm
≥ 2.9.0
< 6.0.1
6.0.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/yeoman/environment/security/advisories/GHSA-vv9j-gjw2-j8wp
NVD — CVE-2026-42089 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42089
Yeoman environment Source Repository REPOSITORY
https://github.com/yeoman/environment/pull/753
Security Fix Commit FIX COMMIT
https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b6a1fa
Yeoman environment Source Repository REPOSITORY
https://github.com/yeoman/environment

Frequently Asked Questions

What is CVE-2026-42089?
CVE-2026-42089 is a security vulnerability in Yeoman environment involving yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation under CWE-829: Inclusion of Functionality from Untrusted Control Sphere.
Which Yeoman environment versions are affected?
Affected versions include releases prior to 6.0.1 across affected packages: yeoman-environment.
What version fixes CVE-2026-42089?
Upgrading to 6.0.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is yeoman-environment affected?
Yes, yeoman-environment is affected in releases prior to 6.0.1. Upgrade your dependency to 6.0.1 or later.
What is the CVSS score of CVE-2026-42089?
CVE-2026-42089 has a CVSS v3.1 base score of 8.6 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
What CWE is associated with CVE-2026-42089?
CVE-2026-42089 is classified under CWE-829: Inclusion of Functionality from Untrusted Control Sphere (The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.).
How can I check npm dependencies for CVE-2026-42089?
Run the dependency tree command: 'npm ls yeoman-environment'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vv9j-gjw2-j8wp",
  "modified" : "2026-07-08T17:36:49Z",
  "published" : "2026-05-26T23:10:38Z",
  "aliases" : [ "CVE-2026-42089" ],
  "summary" : "yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation",
  "details" : "### Impact\n\n`yeoman-environment` versions `>= 2.9.0` and `< 6.0.1` install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap.\n\nThe vulnerable method is `installLocalGenerators()`, which calls `repository.install()` directly without prompting the user.\n\n### Patches\n\nUpgrade to `yeoman-environment` `6.0.1`, which adds an interactive confirmation prompt before installation ([PR #753](https://github.com/yeoman/environment/pull/753)).\n\n### Workarounds\n\nNone.\n\n### Resources\n\n- [Fix commit 78d2af7](https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b6a1fa)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "yeoman-environment"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.9.0"
      }, {
        "fixed" : "6.0.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/yeoman/environment/security/advisories/GHSA-vv9j-gjw2-j8wp"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42089"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/yeoman/environment/pull/753"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b6a1fa"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/yeoman/environment"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-829" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-26T23:10:38Z",
    "nvd_published_at" : "2026-06-16T17:16:40Z"
  }
}