'@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during document parsing. Any application parsing untrusted YAML input with this library exposes full Node.js runtime authority, including environment variable access, filesystem read/write, network access, and subprocess execution, with no safe-mode alternative or opt-out mechanism available.

The @cgauge/yaml npm package contains a critical arbitrary code execution vulnerability tracked as CVE-2026-76833. The vulnerability stems from a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during document parsing. Any application that parses untrusted YAML input using this library is exposed to full Node.js runtime authority. This includes access to environment variables, filesystem read/write operations, network access, and subprocess execution. There is no safe-mode alternative or opt-out mechanism available to mitigate the risk within the library itself. The vulnerability is classified as high severity and affects all users of the package who handle untrusted YAML input.