Yeoman Environment provides a programmatic way to discover, create, and run generators. Between versions 2.9.0 and 6.0.0 the installLocalGenerators() method installs missing local generator packages based on caller‑supplied names without prompting the user. When a downstream consumer injects attacker‑controlled project configuration, the missing generator is fetched and installed automatically, allowing the attacker to execute arbitrary code during the command‑line bootstrap process. This flaw is associated with CWE‑829 (External Control of System or Configuration) and CWE‑426 (Untrusted Search Path). The consequence is that an attacker who can influence the project configuration can gain the same privileges as the user running the Yeoman CLI, potentially compromising the development environment.

The vulnerability exists in yeoman:environment releases from 2.9.0 through 6.0.0. Any installation of those versions that is used by projects with untrusted configuration is affected. Versions prior to 2.9.0 are not known to be impacted; the issue was fixed in 6.0.0.

The CVSS score of 8.6 classifies the flaw as high severity. The EPSS score of <1% indicates a low current probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Nevertheless, the attack vector is likely available in environments where developer machines or build pipelines automatically bootstrap Yeoman projects using untrusted configuration data. An attacker could supply a malicious package name that will be installed on the target system, leading to execution of arbitrary code with the user’s rights. The flaw is also identified as CWE‑426 (Untrusted Search Path) and CWE‑829, and is mitigated by upgrading to 6.0.0 and/or preventing unevaluated project configuration from reaching the vulnerable API.