Executive brief
Yeoman Environment, a tool used by developers to manage and run code generators, contains a security flaw that can lead to the installation of malicious software. If a developer uses a project configuration file provided by an attacker, the tool may automatically download and execute unauthorized code without asking for permission. This could allow an attacker to take full control of a developer's workstation or steal sensitive project data.
Technical details
A vulnerability exists in the `installLocalGenerators()` method of Yeoman Environment where it calls `repository.install()` directly using caller-supplied package names without a confirmation prompt. This is classified as an 'Inclusion of Functionality from Untrusted Control Sphere' (CWE-829). An attacker can exploit this by providing a malicious project configuration to a downstream application that uses the Yeoman API. If the application processes this configuration during CLI bootstrap, it will trigger the installation and execution of arbitrary npm packages. The issue is fixed in version 6.0.1, which introduces an interactive confirmation prompt.
Affected products
- Yeoman yeoman-environment >= 2.9.0, < 6.0.1
Timeline
- 2026-04-09: patched: Fix commit merged into main branch
- 2026-05-22: advisory: GitHub Security Advisory published
- 2026-06-16: disclosed: CVE published to NVD