CVE-2026-42089

creationtimestamp| type| source ---|---|--- 2026-06-16 18:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogewmaa2s2a 2026-06-16 18:51:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moghr2ie5m2x 2026-07-16 19:00:31+00:00| seen|...

CVE-2026-42089 yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass...

20190403-utils (1.0.0), 433bf (0.0.1) +7981 more potentially affected by CVE-2026-42089 via yeoman-environment (>=2.9.5, <=6.0.0)

yeoman-environment NPM version =2.9.5, =0.0.0, =0.1.0, =1.0.1-alpha.0, =2.0.0-beta.2, =1.18.0, =4.2.0, =6.0.0, =1.0.0, =1.0.0, =0.0.0, =0.2.46, =0.24.0 and more Source cves: CVE-2026-42089 Source advisory: SNYK:JS-YEOMANENVIRONMENT-17753983...

20190403-utils (1.0.0), 433bf (0.0.1) +7981 more potentially affected by CVE-2026-42089 via yeoman-environment (>=2.9.5, <=6.0.0)

yeoman-environment NPM version =2.9.5, =0.0.0, =0.1.0, =1.0.1-alpha.0, =2.0.0-beta.2, =1.18.0, =4.2.0, =6.0.0, =1.0.0, =1.0.0, =0.0.0, =0.2.46, =0.24.0 and more Source cves: CVE-2026-42089 Source advisory: OSV:GHSA-VV9J-GJW2-J8WP...