GHSA-vv9j-gjw2-j8wp

Suggest an improvement
Source
https://github.com/advisories/GHSA-vv9j-gjw2-j8wp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-vv9j-gjw2-j8wp/GHSA-vv9j-gjw2-j8wp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vv9j-gjw2-j8wp
Aliases
Published
2026-05-26T23:10:38Z
Modified
2026-07-08T17:45:16Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation
Details

Impact

yeoman-environment versions >= 2.9.0 and < 6.0.1 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap.

The vulnerable method is installLocalGenerators(), which calls repository.install() directly without prompting the user.

Patches

Upgrade to yeoman-environment 6.0.1, which adds an interactive confirmation prompt before installation (PR #753).

Workarounds

None.

Resources

Database specific 
{
    "cwe_ids":  [
        "CWE-829"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-26T23:10:38Z",
    "nvd_published_at":  "2026-06-16T17:16:40Z",
    "severity":  "HIGH"
}
References

Affected packages

npm / yeoman-environment

Package

Name
yeoman-environment
View open source insights on deps.dev
Purl
pkg:npm/yeoman-environment

Affected ranges

Type
SEMVER
Events
Introduced
2.9.0
Fixed
6.0.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-vv9j-gjw2-j8wp/GHSA-vv9j-gjw2-j8wp.json"