CVE-2026-76833 in yaml
Summary
by MITRE • 08/20/2026
@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during document parsing. Any application parsing untrusted YAML input with this library exposes full Node.js runtime authority, including environment variable access, filesystem read/write, network access, and subprocess execution, with no safe-mode alternative or opt-out mechanism available.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The @cgauge/yaml npm package contains a critical arbitrary code execution vulnerability that fundamentally compromises the security of any application relying on it for YAML parsing. This flaw stems from an unsafe implementation of custom tag handling within the library's parser logic. Specifically, when the parser encounters a document containing a custom !js YAML tag, it invokes a construct callback function designed to process these tagged values. Instead of performing safe data conversion or validation, this callback unconditionally executes the eval() function on the string value associated with the tag. This design choice creates a direct path for remote code execution, as any attacker who can influence the content of a YAML document being parsed by an application using this library gains immediate control over the Node.js runtime environment hosting the application.
The technical mechanism behind this vulnerability relies on the inherent dangers of dynamic code evaluation in JavaScript environments. When eval() is called with user-supplied input without rigorous sanitization or context isolation, it allows for the execution of arbitrary JavaScript commands within the scope of the running process. In a Node.js context, this means that an attacker can bypass standard web application security boundaries and interact directly with system-level resources. The lack of any safe-mode alternative or opt-out mechanism exacerbates the severity of the issue, as developers cannot simply disable dangerous features to mitigate the risk while maintaining functionality. Consequently, every instance where untrusted YAML input is processed by this library represents a potential point of total system compromise.
The operational impact of exploiting this vulnerability is severe and comprehensive. An attacker who successfully injects malicious !js tags into parsed YAML data can achieve full authority over the Node.js runtime. This includes unrestricted access to environment variables, which may contain sensitive credentials or configuration secrets. The attacker can also perform arbitrary file system operations, such as reading confidential files from disk or writing malware payloads to persistent storage locations. Furthermore, network capabilities are exposed, allowing for outbound connections that could facilitate data exfiltration or command-and-control communications. Most critically, the ability to execute subprocesses enables the launching of shell commands on the underlying operating system, effectively granting root-level control depending on the privileges under which the Node.js process is running.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-94 Improper Control of Generation of Code or CWE-78 OS Command Injection, reflecting its nature as a code injection flaw that leads to system command execution. From an adversary perspective, this exploit maps directly to MITRE ATT&CK techniques including T1059 Command and Scripting Interpreter for executing arbitrary commands via the Node.js environment, and potentially T1053 Scheduled Task/Job if persistence mechanisms are established through file writes or subprocess calls. The absence of input validation on custom tags violates fundamental principles of secure coding related to data integrity and trust boundaries, treating untrusted YAML content as executable code rather than structured data.
Mitigation strategies must prioritize immediate remediation due to the high severity of this flaw. Applications currently using @cgauge/yaml should upgrade to a patched version if one is available from the maintainer, or more likely, migrate to an alternative YAML parsing library that adheres strictly to standard specifications and does not support arbitrary code execution through custom tags. If migration is not immediately feasible, developers must implement strict input validation at the application layer before passing any data to the parser. This includes rejecting documents containing !js tags entirely, as there is no safe way to sanitize such inputs given the unconditional nature of the eval() call. Additionally, running Node.js applications with minimal privileges and using containerization or sandboxing can help limit the blast radius in case a future vulnerability allows for exploitation, although these measures do not replace the need for fixing the underlying code defect.