The vulnerability arises from the Yeoman-UI / Application Wizard Extension for VS Code using node’s child_process.execSync with a shell string that directly incorporates the ApplicationWizard.installationLocation configuration from a workspace’s settings.json. Because the value is passed to the shell without sanitisation, a malicious settings.json can inject arbitrary OS commands. Consequently, when a developer opens the malicious project and a generator installation is triggered, the injected commands execute with the developer’s privileges. This allows an attacker to run any commands on the developer’s system, effectively achieving remote code execution on a local machine.

SAP Yeoman‑UI extension for Visual Studio Code is affected. No specific version information is provided; the vulnerability may exist in any release that contains the vulnerable execSync call.

The CVSS score is 5.9, indicating moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires a malicious workspace repository that the developer opens, the vector is local and depends on the developer manually loading an untrusted extension configuration. If a user opens such a repository, the attacker can inject and run arbitrary OS commands. The lack of remote network entry means the risk is confined to environments where the VS Code extension runs.