{"action":"Upgrade yeoman-environment to 6.0.1 or later.","affected":[{"fixed":"6.0.1","introduced":"2.9.0"}],"component":"yeoman-environment","cve_ids":["CVE-2026-42089"],"ecosystem":"npm","epss":0.00194,"exploited":false,"fixed_versions":["6.0.1"],"ghsa_id":"GHSA-vv9j-gjw2-j8wp","id":"tcs_01M5KGD02F91BEHTB25WJGHS15","modified_at":"2026-07-08T17:45:16.588278765Z","published_at":"2026-05-26T23:10:38Z","references":["https://osv.dev/vulnerability/GHSA-vv9j-gjw2-j8wp","https://github.com/yeoman/environment/security/advisories/GHSA-vv9j-gjw2-j8wp","https://nvd.nist.gov/vuln/detail/CVE-2026-42089","https://github.com/yeoman/environment/pull/753","https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b6a1fa","https://github.com/yeoman/environment"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-vv9j-gjw2-j8wp","url":"https://osv.dev/vulnerability/GHSA-vv9j-gjw2-j8wp"}],"summary":"yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation"}