CVE-2026-76833: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in cgauge @cgauge/yaml

The @cgauge/yaml npm package (versions <=0.27.0) has an 'Eval Injection' vulnerability (CVE-2026-76833) due to improper neutralization of directives in dynamically evaluated code. Specifically, the custom !js YAML tag's construct callback unconditionally invokes eval() on attacker-supplied strings during YAML parsing. This allows attackers to execute arbitrary JavaScript code with full Node.js runtime privileges, including environment variable access, filesystem read/write, network communication, and subprocess execution. There is no safe-mode or opt-out mechanism in the package to prevent this behavior when parsing untrusted input.

Successful exploitation results in arbitrary code execution within the Node.js runtime environment. This grants attackers full control over the host environment, including access to environment variables, filesystem operations, network communications, and the ability to spawn subprocesses. The vulnerability poses a high security risk to any application that parses untrusted YAML input using the affected versions of @cgauge/yaml.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid parsing untrusted YAML input with @cgauge/yaml versions up to 0.27.0. Consider using alternative YAML parsing libraries that do not evaluate code or provide safe parsing modes.