# CVE-2026-76833: cgauge yaml arbitrary code execution via eval injection

Source: https://junglewise.ai/threats/cve-2026-76833-cgauge-yaml-arbitrary-code-execution-via-eval-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76833 · Severity: high · CVSS 7.8 · Published 2026-08-20

The @cgauge/yaml library is an npm package used to parse YAML configuration files in Node.js applications. The package contains a critical code execution flaw that allows attackers to run arbitrary JavaScript on the server by embedding a special !js tag in YAML input. Any application that parses untrusted YAML with this library can be compromised, giving attackers full access to the server's environment variables, files, network, and ability to launch further attacks.

## Quick answers

**Is CVE-2026-76833 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76833 being exploited in the wild.

**How severe is CVE-2026-76833?** High severity, with a CVSS score of 7.8, published 20 August 2026.

**Which products and versions are affected?** cgauge yaml <unknown>.

**Is there a fix for CVE-2026-76833?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76833 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-76833?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an eval injection (CWE-95) in the @cgauge/yaml parser. The library implements a custom !js YAML tag with a construct callback that unconditionally calls eval() on the tag's string value during document parsing. This occurs in every schema the library builds with no safe mode, opt-out flag, or documentation warning. An attacker can craft a YAML document containing !js tags that execute arbitrary JavaScript in the Node.js runtime context, gaining access to process.env, filesystem operations (readFileSync/writeFileSync), network access, and subprocess execution. The vulnerability is reachable via the network/remote attack vector if the application parses untrusted YAML input. No patches or safe-load alternative are documented as available in the advisory timeline.

## Affected products

- cgauge yaml <unknown>

## Timeline

- 2026-07-03: disclosed: Vulnerability disclosed by reporter Arjun Jain
- 2026-08-20: advisory: CVE-2026-76833 published on NVD

## References

- [https://gist.github.com/arjunjaincs/35da3a80b4b16f324f194acec18489ba](https://gist.github.com/arjunjaincs/35da3a80b4b16f324f194acec18489ba)
- [https://github.com/cgauge/packages](https://github.com/cgauge/packages)