yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-42089 · Microsoft / collected KEV context

EUVD-2026-37131

GHSA-vv9j-gjw2-j8wp

cve-program · CVE-2026-42089

• https://github.com/yeoman/environment/security/advisories/GHSA-vv9j-gjw2-j8wp
• https://github.com/yeoman/environment/pull/753
• https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b6a1fa

euvd · EUVD-2026-37131

• https://github.com/yeoman/environment/security/advisories/GHSA-vv9j-gjw2-j8wp
• https://github.com/yeoman/environment/pull/753
• https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b6a1fa

nvd · CVE-2026-42089

• https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b6a1fa
• https://github.com/yeoman/environment/pull/753
• https://github.com/yeoman/environment/security/advisories/GHSA-vv9j-gjw2-j8wp

osv · GHSA-vv9j-gjw2-j8wp

• https://github.com/yeoman/environment/security/advisories/GHSA-vv9j-gjw2-j8wp
• https://nvd.nist.gov/vuln/detail/CVE-2026-42089
• https://github.com/yeoman/environment/pull/753
• https://github.com/yeoman/environment/commit/78d2af7e60294784b8a8b3b3b5099c6874b6a1fa
• https://github.com/yeoman/environment

No related operational record is retained in the current change model.