CVE-2026-89116: CWE-78: Improper Neutralization of Special Elements used in an OS Command in SAP_SE SAP yeoman-ui

The SAP yeoman-ui component uses child_process.execSync with a shell string for generator installation and uninstallation. The ApplicationWizard.installationLocation VS Code workspace configuration value is passed directly to the shell without sanitization, leading to improper neutralization of special elements (CWE-78). A malicious workspace repository can craft a settings.json file that injects OS commands, allowing arbitrary command execution with the developer's privileges upon opening the project and triggering generator installation.

An attacker who can supply a malicious VS Code workspace repository can execute arbitrary OS commands with the privileges of the developer running the SAP yeoman-ui generator installation. This could lead to confidentiality breaches (high impact on confidentiality), limited integrity impact, and no impact on availability as per the CVSS vector. The attack requires user interaction (opening the project) and has a high attack complexity due to the need to manipulate workspace settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted VS Code workspace repositories that use SAP yeoman-ui or triggering generator installations from untrusted sources.