CVE-2026-89116
OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value. Because the value was passed directly to the shell without sanitisation, a malicious workspace repository could craft a settings.json that injects OS commands when a developer opens the project and triggers a generator installation.
| Vendor | sap_se |
| Product | sap yeoman-ui |
| Published | Oct 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for sap_se sap yeoman-ui
Be the first to know when new medium vulnerabilities affecting sap_se sap yeoman-ui are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
SAP_SE / SAP yeoman-ui
?1.25.1