CVE-2026-89116 | SAP yeoman-ui up to 1.25.1 Workspace Settings settings.json child_process.execSync installationLocation os command injection

October 13, 2026 Yanac

A vulnerability was found in SAP yeoman-ui up to 1.25.1. It has been classified as critical. Affected by this issue is the function child_process.execSync of the file settings.json of the component Workspace Settings. Performing a manipulation of the argument installationLocation results in os command injection.

This vulnerability is cataloged as CVE-2026-89116. It is possible to initiate the attack remotely. There is no exploit available.VulDB Recent EntriesRead More