Description

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during document parsing. Any application parsing untrusted YAML input with this library exposes full Node.js runtime authority, including environment variable access, filesystem read/write, network access, and subprocess execution, with no safe-mode alternative or opt-out mechanism available.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-20T14:18:00.137Z",
  "pubdate": "2026-08-20T14:18:00.137Z",
  "executiveSummary": "The @cgauge/yaml npm package suffers from an arbitrary code execution vulnerability stemming from insecure YAML parsing mechanisms.\nSpecifically, the library implements a custom !js YAML tag whose construct callback unconditionally invokes the eval() function on attacker-supplied string values during the document parsing phase.\nWhen an application processes untrusted YAML input using this vulnerable library, it grants attackers full Node.js runtime authority.\nThe resulting impact includes unauthorized access to environment variables, arbitrary filesystem read and write operations, network access capabilities, and the execution of arbitrary operating system subprocesses.\nThis vulnerability introduces severe risk implications to any host system running the affected software, as there is currently no safe-mode alternative, sanitization layer, or configuration-based opt-out mechanism available to prevent the execution of embedded JavaScript payloads.\nExploitation requires an attacker to successfully supply malicious YAML data containing the targeted tag structure to an application configured to parse it with the affected package.",
  "technicalDetails": "The root cause of this vulnerability lies in the design of the YAML parsing implementation within the @cgauge/yaml npm package, which natively evaluates embedded JavaScript code without validation or sandboxing.\nDuring the parsing of a YAML document, the parser encounters custom type definitions and triggers associated construct callbacks.\nThe vulnerable component specifically registers a custom !js YAML tag.\nThe construct callback associated with this tag processes string values from the parsed document and passes them directly into the JavaScript eval() function without any intermediate checks, type restrictions, or containment measures.\nThe attack flow proceeds as follows: an adversary crafts a malicious YAML payload containing the !js tag followed by a string representing arbitrary JavaScript code.\nWhen the vulnerable application invokes the package's parsing functions against this untrusted input, the YAML parser interprets the custom tag and executes the registered construct callback.\nThe callback immediately executes the supplied string inside the local Node.js runtime via eval().\nBecause Node.js applications execute with the privileges of the user running the process, this behavior grants the attacker complete system access.\nPost-exploitation capabilities include reading and writing sensitive files on the filesystem, extracting environment variables containing secrets or API keys, initiating outbound network connections for data exfiltration or command and control, and spawning child processes to execute arbitrary system commands.\nAuthentication and privilege requirements are entirely dependent on the host application's exposure; if the YAML parsing endpoint is publicly accessible or processes input from unauthenticated users, remote code execution can be achieved without credentials.\nNetwork exposure is similarly determined by the integration context within downstream applications, but any exposed parsing routine handling untrusted payloads presents an immediate vector for complete system compromise."
}