CVE-2026-89116
Received Received - Intake

Command Injection in VS Code Extension

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: SAP SE

Description
The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value. Because the value was passed directly to the shell without sanitisation, a malicious workspace repository could craft a settings.json that injects OS commands when a developer opens the project and triggers a generator installation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-89116
EUVD
EUVD-2026-98196

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SAP_SE SAP yeoman-ui ?1.25.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the use of child_process.execSync in VS Code with a shell string for generator installation and uninstallation. An attacker can exploit it by manipulating the ApplicationWizard.installationLocation workspace configuration value to inject and execute arbitrary OS commands with the developer's privileges. This occurs because the value is passed directly to the shell without sanitization.

Detection Guidance

Check VS Code workspace configurations for suspicious ApplicationWizard.installationLocation values. Inspect settings.json files in project directories for unexpected OS command patterns or shell metacharacters. Monitor for unexpected generator installation or uninstallation processes triggered by workspace changes.

Impact Analysis

If exploited, this vulnerability allows an attacker to run malicious OS commands on your system with your privileges. This could lead to unauthorized access, data theft, or system compromise. Developers opening a crafted workspace repository could trigger the injection without realizing it.

Compliance Impact

This vulnerability could lead to unauthorized command execution on a developer's system, potentially exposing sensitive data or violating compliance requirements such as GDPR or HIPAA if such data is processed or stored on the affected system.

Mitigation Strategies

Disable child_process.execSync usage in VS Code extensions. Validate and sanitize all workspace configuration inputs. Restrict VS Code workspace settings to prevent untrusted modifications. Update to patched versions of affected tools.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89116. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart