SAP Yeoman UI EUVD-2026-98196

Exploitation requires that the SAP Yeoman UI (app-studio-toolkit) extension be installed in VS Code, and that the victim developer open an attacker-controlled workspace repository containing a crafted settings.json which sets the ApplicationWizard.installationLocation configuration value to an injected shell command. The command only fires when the developer triggers a generator installation or uninstallation, which invokes child_process.execSync with the unsanitized value as a shell string. Limiting factors: the attack depends on social engineering (the developer must clone/open the malicious project and then initiate a generator action), it runs only with the developer's own privileges, and it is confined to developer workstations rather than servers - there is no unauthenticated remote-service exposure.

The input CVSS 3.1 base score is 5.9 (Medium) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N. Several signals conflict and should be verified. First, the vector marks UI:N (no user interaction), but the description explicitly requires a developer to open a malicious workspace and trigger a generator installation - that is effectively active user interaction, so UI:N appears understated. Second, AV:N (network) is questionable: the injection vector is a settings.json inside a workspace repository opened locally in VS Code, which is closer to a local/workspace attack than a direct network-service exploit. Third, the impact metrics C:H/I:L/A:N undersell the outcome - arbitrary OS command execution with the developer's privileges realistically yields full confidentiality, integrity, and availability impact. No EPSS score, CISA KEV listing, or public POC was provided, so exploitation likelihood cannot be quantified from the data; status is 'no public exploit identified at time of analysis.' Net real-world risk is moderate and gated by social engineering (the developer must clone/open an attacker-controlled repo and run a generator), but the consequence (code execution as the developer, a common path to credential and source-code theft in dev environments) is severe. This is a credible developer-supply-chain risk for SAP tooling users rather than a mass-exploitable internet-facing flaw.

An attacker publishes a malicious repository (e.g., a tempting SAP sample project) containing a crafted .vscode/settings.json that sets ApplicationWizard.installationLocation to a value embedding shell metacharacters and commands. A developer clones and opens the project in VS Code with the SAP Yeoman UI extension and triggers a generator install/uninstall, causing child_process.execSync to run the injected commands with the developer's privileges. No public exploit code was identified in the provided data, but the technique is straightforward shell injection.