EUVD-2026-37131

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass...

CVE-2026-42089: Inclusion of Functionality from Untrusted Control Sphere

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass...

Unsafe Dependency Resolution

Overview yeoman-environment is a Handles the lifecyle and bootstrapping of generators in a specific environment Affected versions of this package are vulnerable to Unsafe Dependency Resolution in the installLocalGenerators process. An attacker can achieve arbitrary code execution by supplying...