CVE-2026-89116

The Yeoman-UI / Application Wizard Extension for VS Code is vulnerable to OS Command Injection (CWE-78). The issue stems from the use of child_process.execSync with a shell string during generator installation and uninstallation. Specifically, the ApplicationWizard.installationLocation workspace ...

CVE-2026-89116 OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

Malicious code in yeoman-ui-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ace234b9c2e9e1c18cb7d82af141cf423a3f8e847c62d929c2fca7557bc8509 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7346 Malicious code in yeoman-ui-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ace234b9c2e9e1c18cb7d82af141cf423a3f8e847c62d929c2fca7557bc8509 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...