CVE-2026-76833

Name of the Vulnerable Software and Affected Versions @cgauge/yaml npm package (affected versions not specified)

Description An issue exists where attackers can execute arbitrary JavaScript by embedding a custom !js YAML tag. During document parsing, the construct callback unconditionally calls the eval() function on attacker-supplied string values. Applications parsing untrusted YAML input using this library are exposed to full Node.js runtime authority, which includes the ability to access environment variables, read and write to the filesystem, access the network, and execute subprocesses. There is no safe-mode alternative or opt-out mechanism available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.