All vulnerabilities
CVE-2026-89116GHSA-vm9q-mf35-jwpx

OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code

SAP_SE SAP yeoman-uiApplications & CMS
Open in ThreatlineRecord JSON
CVSS
5.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.25.2Fixed versionGitHub
Published13 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

  • 1.25.2Application Wizard, visual studio codeGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value. Because the value was passed directly to the shell without sanitisation, a malicious workspace repository could craft a settings.json that injects OS commands when a developer opens the project and triggers a generator installation.

Text from CVE List

Affected versions 2

  • SAP yeoman-uiaffected: ?1.25.1CVE List
  • Application Wizard, visual studio code<= 1.25.1GitHub

References 2