CVE-2026-76833
Received Received - Intake

Arbitrary Code Execution in @cgauge/yaml npm Package

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description
@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during document parsing. Any application parsing untrusted YAML input with this library exposes full Node.js runtime authority, including environment variable access, filesystem read/write, network access, and subprocess execution, with no safe-mode alternative or opt-out mechanism available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-76833
EUVD
EUVD-2026-63350

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cgauge yaml to 0.27.0 (inc)
cgauge yaml *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an arbitrary code execution flaw in the @cgauge/yaml npm package. It allows attackers to run arbitrary JavaScript by embedding a custom !js YAML tag. The library's parser unconditionally uses eval() on attacker-supplied strings during document parsing, granting full Node.js runtime access with no safe mode available.

Detection Guidance

Check if the @cgauge/yaml package is installed in your Node.js project using 'npm list @cgauge/yaml'. If present, inspect YAML files for !js tags or unsanitized !content and !include tags that may execute arbitrary code or access sensitive files.

Impact Analysis

If you use this library to parse untrusted YAML input, attackers can execute commands, access environment variables, read/write files, make network requests, or run subprocesses. This could lead to data breaches, system compromise, or unauthorized actions on your system.

Compliance Impact

This vulnerability could lead to violations of GDPR (data breaches), HIPAA (unauthorized access to health data), or other regulations by enabling attackers to access, modify, or exfiltrate sensitive data. Compliance requires immediate mitigation or removal of the vulnerable library.

Mitigation Strategies

Remove the @cgauge/yaml package immediately using 'npm uninstall @cgauge/yaml'. Replace it with a safer alternative like js-yaml and ensure all YAML parsing disables custom tags. Audit applications for any usage of !js, !content, or !include tags.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76833. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart