yeoman environment vulnerabilities

Latest yeoman environment CVEs

Newest publication first

1. CVE-2026-42089 yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

   Published 2026-06-16

   High·CVSS 8.6 EPSS 0.17%

   Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream co...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.