yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

@@ -226,9 +226,23 @@ class FullEnvironment extends EnvironmentBase {
    * @param  {Object} packages - packages to install key(packageName): value(versionRange).
    * @return  {Boolean} - true if the install succeeded.
    */
-  async installLocalGenerators(packages: Record<string, string | undefined>) {
+  async installLocalGenerators(packages: Record<string, string | undefined>, forceInstall = false) {
     const entries = Object.entries(packages);
     const specs = entries.map(([packageName, version]) => `${packageName}${version ? `@${version}` : ''}`);
+    if (forceInstall) {
+      this.adapter.log.info(`Force install is enabled. Proceeding with installation.`);
+    } else {
+      const { aproveInstall } = await this.adapter.prompt({
+        message: `The following packages need to be installed in the local repository: ${specs.join(', ')}. Do you want to proceed?`,
+        type: 'confirm',
+        name: 'aproveInstall',
+        default: false,
+      });
+      if (!aproveInstall) {
+        throw new Error(`Installation of ${specs.join(', ')} is declined by the user. Install manually and try again.`);
+      }
+    }
+    this.adapter.log.info(`The following packages will be installed in the local repository: ${specs.join(', ')}.`);
     const installResult = await this.repository.install(specs);
     const failToInstall = installResult.find(result => !result.path);
     if (failToInstall) {

@@ -3,7 +3,8 @@ import path, { dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
 import { stub } from 'sinon';
-import { beforeEach, describe, it } from 'esmocha';
+import { beforeEach, describe, esmocha, expect, it } from 'esmocha';
+import { TestAdapter } from 'yeoman-test';
 import { prepareCommand } from '../src/commands.ts';
 import Environment from '../src/index.ts';
 
@@ -12,11 +13,45 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
 describe('environment (command)', () => {
+  describe('#execute()', () => {
+    let environment;
+    let adapter;
+
+    beforeEach(async () => {
+      adapter = new TestAdapter();
+      environment = new Environment({ skipInstall: true, dryRun: true, adapter });
+    });
+
+    describe('with non existing generator', () => {
+      it('declining installation', async () => {
+        adapter.addAnswers({
+          aproveInstall: false,
+        });
+        environment.repository.install = esmocha.fn().mockReturnValue(Promise.resolve([]));
+        await expect(environment.execute('commands:options')).rejects.toThrow(
+          /Installation of generator-commands is declined by the user. Install manually and try again/,
+        );
+        expect(environment.repository.install).not.toHaveBeenCalled();
+      });
+
+      it('approving installation', async () => {
+        adapter.addAnswers({
+          aproveInstall: true,
+        });
+        environment.repository.install = esmocha.fn().mockReturnValue(Promise.resolve([]));
+        await expect(environment.execute('commands:options')).rejects.toThrow(
+          /You don't seem to have a generator with the name “generator-commands” installed./,
+        );
+        expect(environment.repository.install).toHaveBeenCalledWith(['generator-commands']);
+      });
+    });
+  });
+
   describe('#execute() with options', () => {
     let environment;
 
     beforeEach(async () => {
-      environment = new Environment([], { skipInstall: true, dryRun: true });
+      environment = new Environment({ skipInstall: true, dryRun: true });
       environment.adapter.log = stub();
       await environment.register(path.join(__dirname, 'fixtures/generator-commands/generators/options'));
     });
@@ -87,7 +122,7 @@ describe('environment (command)', () => {
     let environment;
 
     beforeEach(() => {
-      environment = new Environment([], { skipInstall: true, dryRun: true });
+      environment = new Environment({ skipInstall: true, dryRun: true });
       environment.adapter.log = stub();
       environment.register(path.join(__dirname, 'fixtures/generator-commands/generators/arguments'));
     });