Arbitrary Code Execution in cgauge/yaml npm Package by cgauge

CVE-2026-76833

What is CVE-2026-76833?

The cgauge/yaml npm package is vulnerable to arbitrary code execution, allowing malicious users to execute arbitrary JavaScript code by leveraging a custom !js YAML tag during document parsing. This vulnerability is triggered as the construct callback for this tag calls eval() on attacker-controlled input, providing full access to the Node.js runtime. Consequently, applications processing untrusted YAML data with this library risk exposing system-level controls, including access to sensitive environment variables, file system operations, network communications, and the ability to spawn subprocesses. The absence of a safe-mode option or an opt-out capability further exacerbates the security risks posed by this vulnerability.

References