CVE-2026-76833: @cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag
@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during document parsing. Any application parsing untrusted YAML input with this library exposes full Node.js runtime authority, including environment variable access, filesystem read/write, network access, and subprocess execution, with no safe-mode alternative or opt-out mechanism available.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that parse untrusted YAML using npm/@cgauge/yaml are exposed. Successful exploitation gives code the same Node.js runtime authority as the parsing application, including access to environment variables, files, network resources, and subprocess execution.
What must an attacker provide to exploit it?
An attacker needs to cause the application to parse YAML they control containing a custom !js tag. During parsing, the tag's construct callback passes the attacker-controlled string to eval().
Is there a safe-mode setting or opt-out that prevents exploitation?
No. The provided information states that the package has no safe-mode alternative or opt-out mechanism for this behavior.