cyfenced.com →

[ CVE-2026-89116 · Published 13 Oct 2026 ]

Vulnerability in SAP_SE SAP yeoman-ui

CVSS 5.9 EPSS <1%2 agency advisoriesNo fix listed yet

[ Description ]Official description

The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value. Because the value was passed directly to the shell without sanitisation, a malicious workspace repository could craft a settings.json that injects OS commands when a developer opens the project and triggers a generator installation.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1300

    Multiple vulnerabilities in SAP products Translated from French

    Multiple vulnerabilities have been discovered in SAP products. Some of them allow an attacker to cause remote arbitrary code execution, a breach of data confidentiality and SQL injection (SQLi).

    CVE-2025-42938CVE-2026-89120CVE-2026-89116+19 more CVEs
  • BSI CERT-BundWID-SEC-2026-3888

    SAP Patch Day Oktober 2026: Multiple vulnerabilities Translated from German

    CVE-2026-76972CVE-2026-89110CVE-2026-24316+19 more CVEs

[ References ]References