CVE-2026-42089
1 advisory.
npm/yeoman-environment CVE-2026-42089: high 8.6
yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation
Action: Upgrade yeoman-environment to 6.0.1 or later.
npm i yeoman-environment@6.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.9.0 | 6.0.1 | - |
Fixed versions
| 6.0.1 |
Sources
- osv: GHSA-vv9j-gjw2-j8wp
- https://github.com/yeoman/environment/security/advisories/GHSA-vv9j-gjw2-j8wp
- https://nvd.nist.gov/vuln/detail/CVE-2026-42089
- https://github.com/yeoman/environment/pull/753
- https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b6a1fa
- https://github.com/yeoman/environment
CVE-2026-42089 · published · modified · JSON