CVE-2026-89116 in yeoman-ui
Summary
by MITRE • 10/13/2026
The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value. Because the value was passed directly to the shell without sanitisation, a malicious workspace repository could craft a settings.json that injects OS commands when a developer opens the project and triggers a generator installation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability stems from an insecure implementation of command execution within a software development tooling context, specifically involving the Node.js child_process.execSync function. This API is designed to execute shell commands synchronously, but it inherently poses significant security risks when provided with unsanitized input strings that are interpreted by the operating system's command interpreter. In this specific instance, the affected code utilized execSync to manage generator installation and uninstallation processes for a development environment, likely within an Integrated Development Environment such as Visual Studio Code. The critical flaw lies in how the application handles user-provided configuration values, specifically the ApplicationWizard.installationLocation setting found in workspace settings files like settings.json. Instead of validating or sanitizing this input to ensure it represents only valid file system paths, the code passes the raw string directly into the shell command construction logic. This lack of input validation creates a classic Command Injection vulnerability, allowing an attacker who controls the content of the configuration file to inject arbitrary operating system commands that will be executed with the privileges of the user running the application.
The operational impact of this flaw is severe because it targets developers during routine workflow activities such as opening a project or triggering generator installations. An adversary can craft a malicious workspace repository containing a specially crafted settings.json file where the installation location value contains shell metacharacters and payload commands. When an unsuspecting developer opens this workspace, the application reads the configuration and immediately executes the injected code without any user interaction beyond opening the folder. This results in Remote Code Execution with the context of the logged-in user. Depending on the security posture of the development machine, this could lead to full system compromise, including data exfiltration, installation of persistent backdoors, or lateral movement within a corporate network if the developer has access to sensitive internal resources. The attack vector is particularly dangerous because it exploits trust in local workspace configurations and occurs before any explicit user action like clicking an install button, making detection difficult for users who may not inspect their configuration files closely.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The root cause is the failure to properly neutralize special elements within user input before using it in a command string. Furthermore, from a tactical standpoint, this behavior corresponds to ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving shell commands like sh or cmd.exe depending on the operating system. The attack also leverages social engineering principles by embedding malicious code within standard configuration files that developers routinely edit, which can be categorized under initial access vectors where attackers use trusted artifacts to gain execution rights.
To mitigate this vulnerability, immediate remediation should focus on replacing the unsafe execSync call with safer alternatives such as child_process.execFile or spawn, which do not invoke a shell by default and thus prevent command injection through metacharacters. If shell invocation is absolutely necessary for specific legacy reasons, strict input validation must be implemented to ensure that configuration values contain only expected alphanumeric characters, hyphens, underscores, and path separators, rejecting any string containing spaces or special symbols like semicolons, pipes, or ampersands. Additionally, implementing allowlists for valid installation paths rather than relying on negative filtering can significantly reduce the attack surface. Developers should also be educated about the risks of executing code based on workspace configuration files from untrusted sources and encouraged to review settings.json contents before opening repositories obtained from external parties. Updating affected packages to versions that include these security patches is essential, alongside auditing existing projects for similar patterns where user input might inadvertently influence system command execution.