CVE-2026-42089
CVE-2026-42089: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh8.2
High [CVE-2026-42089] Arbitrary code execution via unconfirmed package installation
CVE-2026-42089Source published Source updated
Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap. The vulnerable method is installLocalGenerators(), which calls repository.install() directly without prompting the user. This issue has been fixed in version 6.0.0. This vulnerability allows an attacker to install arbitrary packages and execute code during command-line interface (CLI) bootstrap. The primary impact is arbitrary code execution. This…
- Affected products in this advisory
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- 2.9.0
- Source-reported fixed versions
- 6.0.0
- Mitigation guidance
- To mitigate this issue, users should avoid processing project configurations from untrusted sources with Yeoman Environment. Ensure that all project configurations and generator package names are from trusted origins to prevent the installation of arbitrary packages and subsequent code execution.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.