Sap Yeoman Ui
Monthly
Command injection in SAP Yeoman UI (app-studio-toolkit) enables an attacker to execute arbitrary OS commands with the developer's privileges by crafting a malicious workspace settings.json that sets ApplicationWizard.installationLocation to a shell payload. The command fires when the developer triggers a generator installation or uninstallation, which invokes child_process.execSync with the unsanitized value. The assessed CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local exploitation requiring user interaction, with high impact to confidentiality, integrity, and availability on the developer workstation; no confirmed active exploitation or public exploit code is identified in the provided data.
Command injection in SAP Yeoman UI (app-studio-toolkit) enables an attacker to execute arbitrary OS commands with the developer's privileges by crafting a malicious workspace settings.json that sets ApplicationWizard.installationLocation to a shell payload. The command fires when the developer triggers a generator installation or uninstallation, which invokes child_process.execSync with the unsanitized value. The assessed CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local exploitation requiring user interaction, with high impact to confidentiality, integrity, and availability on the developer workstation; no confirmed active exploitation or public exploit code is identified in the provided data.