yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation
Impact
yeoman-environment versions >= 2.9.0 and < 6.0.1 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap.
The vulnerable method is installLocalGenerators(), which calls repository.install() directly without prompting the user.
Patches
Upgrade to yeoman-environment 6.0.1, which adds an interactive confirmation prompt before installation (PR #753).
Workarounds
None.
Resources
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | yeoman-environment | >= 2.9.0, < 6.0.1 | 6.0.1 |
References
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-829- Platform
- npm
- Package
yeoman-environment- Disclosed
- 26.05.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vv9j-gjw2-j8wp - CC BY 4.0
Vulnerability history: yeoman-environment
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.