CVE-2026-76833 is an arbitrary code execution vulnerability in the @cgauge/yaml npm package. The flaw is caused by the package's handling of a custom !js YAML tag whose construct callback directly invokes eval() on attacker-supplied string values during YAML parsing. This allows an attacker to execute arbitrary JavaScript code within the Node.js runtime environment, granting access to environment variables, filesystem operations, network communication, and subprocess execution. The vulnerability affects any application that parses untrusted YAML input using this package, and no mitigation or safe parsing mode is provided by the library.

Successful exploitation allows an attacker to execute arbitrary JavaScript code with full Node.js runtime privileges, leading to complete compromise of the host environment. This includes unauthorized access to environment variables, reading and writing files, network communication, and spawning subprocesses. The vulnerability poses a critical risk to applications that process untrusted YAML data with this package.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid parsing untrusted YAML input with the @cgauge/yaml package. Consider using alternative YAML parsers that do not evaluate code or provide safe parsing modes.