Executive brief
The @cgauge/yaml library is an npm package used to parse YAML configuration files in Node.js applications. The package contains a critical code execution flaw that allows attackers to run arbitrary JavaScript on the server by embedding a special !js tag in YAML input. Any application that parses untrusted YAML with this library can be compromised, giving attackers full access to the server's environment variables, files, network, and ability to launch further attacks.
Technical details
The vulnerability is an eval injection (CWE-95) in the @cgauge/yaml parser. The library implements a custom !js YAML tag with a construct callback that unconditionally calls eval() on the tag's string value during document parsing. This occurs in every schema the library builds with no safe mode, opt-out flag, or documentation warning. An attacker can craft a YAML document containing !js tags that execute arbitrary JavaScript in the Node.js runtime context, gaining access to process.env, filesystem operations (readFileSync/writeFileSync), network access, and subprocess execution. The vulnerability is reachable via the network/remote attack vector if the application parses untrusted YAML input. No patches or safe-load alternative are documented as available in the advisory timeline.
Affected products
- cgauge yaml <unknown>
Timeline
- 2026-07-03: disclosed: Vulnerability disclosed by reporter Arjun Jain
- 2026-08-20: advisory: CVE-2026-76833 published on NVD