CVE-2026-76833

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during document parsing. Any application parsing untrusted YAML input with this library exposes full Node.js runtime authority, including environment variable access, filesystem read/write, network access, and subprocess execution, with no safe-mode alternative or opt-out mechanism available.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/arjunjaincs/35da3a80b4b16f324f194acec18489ba
https://github.com/cgauge/packages
https://www.vulncheck.com/advisories/cgauge-yaml-npm-package-arbitrary-code-execution-via-eval-yaml-tag
https://gist.github.com/arjunjaincs/35da3a80b4b16f324f194acec18489ba

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El paquete npm @cgauge/yaml contiene una vulnerabilidad de ejecución de código arbitrario que permite a los atacantes ejecutar JavaScript arbitrario incrustando una etiqueta YAML personalizada !js cuyo callback de construcción llama incondicionalmente a eval() sobre valores de cadena proporcionados por el atacante durante el análisis del documento. Cualquier aplicación que analiza entrada YAML no confiable con esta biblioteca expone la autoridad completa del tiempo de ejecución de Node.js, incluyendo acceso a variables de entorno, lectura/escritura del sistema de archivos, acceso a la red y ejecución de subprocesos, sin alternativa de modo seguro o mecanismo de exclusión voluntaria disponible.

Information

Published : 2026-08-20 14:18

Updated : 2026-10-18 20:10

NVD link : CVE-2026-76833

Mitre link : CVE-2026-76833

CVE.ORG link : CVE-2026-76833

JSON object : View

Products Affected

No product.

CWE

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

{"id": "CVE-2026-76833", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76833", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-20T14:28:52.031389Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "cgauge", "product": "@cgauge/yaml", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.27.0"}], "packageURL": "pkg:cargo/dua-cli", "defaultStatus": "affected"}]}], "published": "2026-08-20T14:18:00.137", "references": [{"url": "https://gist.github.com/arjunjaincs/35da3a80b4b16f324f194acec18489ba", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/cgauge/packages", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/cgauge-yaml-npm-package-arbitrary-code-execution-via-eval-yaml-tag", "source": "disclosure@vulncheck.com"}, {"url": "https://gist.github.com/arjunjaincs/35da3a80b4b16f324f194acec18489ba", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-95"}]}], "descriptions": [{"lang": "en", "value": "@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during document parsing. Any application parsing untrusted YAML input with this library exposes full Node.js runtime authority, including environment variable access, filesystem read/write, network access, and subprocess execution, with no safe-mode alternative or opt-out mechanism available."}, {"lang": "es", "value": "El paquete npm @cgauge/yaml contiene una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo arbitrario que permite a los atacantes ejecutar JavaScript arbitrario incrustando una etiqueta YAML personalizada !js cuyo callback de construcci\u00f3n llama incondicionalmente a eval() sobre valores de cadena proporcionados por el atacante durante el an\u00e1lisis del documento. Cualquier aplicaci\u00f3n que analiza entrada YAML no confiable con esta biblioteca expone la autoridad completa del tiempo de ejecuci\u00f3n de Node.js, incluyendo acceso a variables de entorno, lectura/escritura del sistema de archivos, acceso a la red y ejecuci\u00f3n de subprocesos, sin alternativa de modo seguro o mecanismo de exclusi\u00f3n voluntaria disponible."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "disclosure@vulncheck.com"}