CVE-2026-76833

Executive Summary

CVE-2026-76833 is an arbitrary code execution vulnerability in the @cgauge/yaml npm package. The flaw arises from a custom !js YAML tag whose constructor callback unconditionally invokes eval() on attacker-controlled string values during document parsing, granting full Node.js runtime authority to any attacker who can supply YAML input to an application using this package. All versions of the package appear affected, and no patch, workaround, or safe-mode alternative has been published. Applications that parse untrusted YAML — including configuration files, user uploads, message queues, or CI pipeline inputs — are exposed to complete system compromise.

Technical Analysis

The vulnerability resides in the custom type-resolution mechanism of the @cgauge/yaml npm package. The package defines a YAML schema that registers a !js tag. When the YAML parser encounters this tag during document parsing, it instantiates a constructor callback for that tag type. Critically, that callback performs an unconditional eval() call on the string value supplied adjacent to the tag.

The core mechanism is as follows:

1. Tag Registration: The library registers a custom tag descriptor for !js.
2. Constructor Callback: The tag's constructor invokes JavaScript's eval() function directly on the raw string extracted from the YAML document.
3. No Sanitization: There is no input validation, output sanitization, or sandboxing before the eval() call. The string is executed verbatim in the current Node.js process context.
4. No Safe-Mode: The library offers no configuration flag or alternative parsing mode that disables the dangerous tag. Every parse operation is equally vulnerable.

The attack surface is any YAML document processed by the library. Because YAML is commonly used for:

• Application configuration files
• Kubernetes manifests
• CI/CD pipeline definitions (GitHub Actions, GitLab CI)
• Infrastructure-as-code templates
• Data serialization in APIs and message queues
• docker-compose files
• Helm charts

…a document reaching the parser from any untrusted source is sufficient to trigger the vulnerability.

Notably, the CVSS vector is AV:L/AC:L/PR:N/UI:R — the attack requires local user interaction, meaning the victim application must parse an attacker-supplied YAML file (such as opening a malicious configuration file or loading a crafted package). The high confidentiality, integrity, and availability scores (C:H/I:H/A:H) reflect that the eval() executes in the full context of the Node.js process with no privilege separation.

The CWE-95 classification (Improper Neutralization of Directives in Dynamically Evaluated Code, i.e., "eval injection") is consistent with the described mechanism: an attacker controls a string that is subsequently evaluated as code.

Exploitation Scenarios

Prerequisite: The target application must use the @cgauge/yaml package to parse YAML documents originating from a source the attacker controls.

Step 1 — Reconnaissance / Target Identification

An attacker identifies applications that bundle the @cgauge/yaml npm package. This can be achieved by:

• Scanning public-facing Node.js applications and inspecting their response headers, package.json disclosures, or JavaScript bundle fingerprints.
• Searching code repositories, public GitHub datasets, or npm dependency graphs for applications referencing the library.
• Inspecting error messages that leak dependency names when malformed YAML is provided to an endpoint.

Step 2 — Flaw Trigger

The attacker delivers a crafted YAML document containing a !js tag followed by a string payload. A minimal trigger document would resemble:

key: !js <attacker-controlled JavaScript string>

No additional software or tooling is required — any text editor or HTTP request with a YAML body suffices.

Step 3 — Payload Execution

Upon parsing, the library’s constructor callback passes the string following !js directly to eval(). The JavaScript string is executed in the Node.js process context, inheriting all runtime capabilities of the application process:

• Environment variable access: process.env can be read to exfiltrate secrets, API keys, database credentials, or cloud provider tokens (AWS, GCP, Azure credentials).

• Filesystem read/write: fs.readFileSync() and fs.writeFileSync() allow reading sensitive files (e.g., /etc/passwd, application private keys) or writing backdoors into webroot.

• Network access: The net or http modules can beacon data to attacker-controlled servers, or perform lateral reconnaissance against internal network segments.

• Subprocess execution: child_process.exec() / child_process.execSync() enable running arbitrary system commands, including dropping reverse shells, installing persistence, or pivoting to other hosts.

Step 4 — Post-Exploitation Impact

Since the eval() executes in the application’s Node.js process, which typically runs with the privileges of a dedicated service account but often with broad filesystem and network access, the attacker achieves full control of the host. In containerized environments, this may provide a foothold for escaping containers if the runtime is misconfigured (e.g., privileged containers or docker socket mounted).

Because the CVSS vector scores availability as HIGH, a simple payload of process.exit(1) is sufficient for denial-of-service.

If no public PoC is yet available, the attack chain above is inferred directly from the CWE-95 vulnerability class and the verbatim description of the eval() unconditionally invoked in the !js tag constructor.

Impact Assessment

Business Impact: Critical. This vulnerability enables full remote code execution on any server or workstation running an application that parses untrusted YAML with the @cgauge/yaml library. Successful exploitation leads to:

• Confidentiality compromise (C:H): Environment variables containing secrets, database credentials, API keys, and service account tokens are exposed.
• Integrity compromise (I:H): Files can be modified, backdoors installed, application logic altered, and data tampered with.
• Availability compromise (A:H): Attackers can terminate processes, destroy data, or render services inoperable.

Because the library is an npm package, the blast radius extends to the entire Node.js ecosystem. Any downstream project that depends on @cgauge/yaml inherits the vulnerability. The dependence is transitive-aware: an application using the package directly OR indirectly through another library is equally susceptible.

The attack vector (AV:L — Local) limits exploitation to scenarios where the attacker can deliver a YAML file that causes the vulnerable application to parse it. While this requires some user interaction (opening a malicious file or fetching an untrusted configuration from a remote source), the following real-world paths elevate the exposure:

• Malicious npm packages that embed YAML payloads installed via automatic dependency resolution.
• Crafted configuration files downloaded by automated deployment tooling.
• YAML attachments opened via web mail clients in applications that preview YAML.
• Documents uploaded to web endpoints that validate or transform YAML content.

The lack of a safe-mode alternative or opt-out mechanism means there is no configuration-level mitigation — every parse operation is vulnerable, regardless of the developer's intent.

Affected Systems: All systems running Node.js applications that use @cgauge/yaml, including web servers, microservices, serverless functions, CI/CD pipelines, and internal automation tools.

Detection Guidance

Sigma Rule

title: CVE-2026-76833 - @cgauge/yaml Arbitrary Code Execution
status: experimental
description: Detects Node.js processes evaluating YAML !js tags, indicating possible exploitation of CVE-2026-76833
logsource:
  category: process_creation
  product: linux
detection:
  selection_node:
    Image|endswith: '/node'
  selection_eval:
    CommandLine|contains: 'eval('
  selection_exfil:
    CommandLine|contains:
      - 'process.env'
      - 'fs.readFileSync'
      - 'child_process'
      - 'net.connect'
  condition: selection_node and selection_exfil
  timeframe: 5m
falsepositives:
  - Legitimate use of eval in Node.js applications
level: high

YARA Rule

rule CVE_2026_76833_YAML_JS_TAG {
    meta:
        author = "Valters IT Security Analyst"
        description = "Detects malicious YAML documents targeting @cgauge/yaml eval vulnerability"
        cve = "CVE-2026-76833"
        date = "2026-02-10"
        severity = "high"
    strings:
        $js_tag = "!js "
        $eval_call = "eval("
        $proc_env = "process.env"
        $child_proc = "child_process"
        $fs_read = "fs.readFileSync"
        $net_sock = "require('net')"
        $http_req = "require('http')"
        $yaml_doc = "yaml.parse"
    condition:
        $js_tag and ($eval_call or $proc_env or $child_proc or $fs_read or $net_sock or $http_req)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-76833 - YAML !js tag payload in HTTP body"; flow:established,to_server; content:"!js "; http_client_body; content:"eval"; http_client_body; distance:0; classtype:attempted-user; sid:202676833; rev:1; metadata:cve CVE-2026-76833;)

Elastic Detection

process where event.action == "exec" and process.name == "node" and
  process.args : "*eval*" and
  process.args : ("*process.env*", "*fs.readFileSync*", "*child_process*", "*net.connect*")

Splunk SPL Query

index=main sourcetype=unix:process:command
  (Image="*/node" OR process="/usr/bin/node")
  AND (CommandLine="*eval*")
  AND (CommandLine="*process.env*" OR CommandLine="*fs.readFileSync*" OR CommandLine="*child_process*" OR CommandLine="*net.connect*")
  | stats count by host, user, CommandLine

Wazuh OSSEC Rule

<group name="detection_cve_2026_76833,">
  <rule id="909910" level="12">
    <if_sid>550</if_sid>
    <field name="file">\.(yaml|yml)$</field>
    <match>!js |eval\(|process\.env|child_process</match>
    <description>CVE-2026-76833 - YAML document containing !js tag with code execution strings</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>cve-2026-76833,yaml,eval-injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — confidence 0/4. No vendor fix, no official advisory, no patched version identified. OSV database lists the package as 0→unfixed meaning all current versions are vulnerable.

1) Immediate Mitigations (Defense-in-Depth)

• Remove or Replace the Library: Migrate to a maintained YAML parser for Node.js that does not implement arbitrary JavaScript evaluation tags. Candidates include js-yaml (without the unsafe schema) or yaml (the maintained core library that requires explicit schema configuration).
• Input Sanitization Filter: If migration is not immediately possible, deploy a pre-parsing filter that detects the literal string !js in any incoming YAML content, rejects the document, and raises an alert. This blocks the known attack vector while leaving the rest of the document processing intact.
• Environment Isolation: Run the application in a sandboxed environment (e.g., gVisor, Firecracker, LXC) that restricts filesystem, network, and subprocess system calls even if code execution occurs.
• Secrets Hygiene: Ensure environment variables used by the Node.js process carry only application-specific, least-privilege credentials. Do not store cloud provider root credentials in the container or process environment.
• Web Application Firewall (WAF) Rules: Deploy WAF rules that reject HTTP requests whose bodies contain the !js tag pattern (content: "!js ").

2) Patch / Upgrade Steps

• No patch currently exists. Monitor the npm package page (https://www.npmjs.com/package/@cgauge/yaml) and the OSV advisory database (https://osv.dev/vulnerability/CVE-2026-76833) for updates.
• When a fixed version is released, upgrade via npm update @cgauge/yaml in each affected project.
• Audit package-lock.json and yarn.lock files to identify all projects with the dependency, including transitive dependencies via npm audit or yarn audit.

3) Long-Term Hardening

• Dependency Management Policy: Adopt a policy that all YAML parsing modules must be safe-by-default, i.e., they must not evaluate code unless explicitly enabled through a documented, opt-in schema. Add an automated CI gate that fails builds when dependencies with known CVEs or unsafe tagging mechanisms are detected.
• Input Validation: Treat all YAML input as untrusted at the architectural level. Prefer JSON or binary formats (e.g., Protocol Buffers) for data interchange where schema enforcement is required.
• Runtime Monitoring: Deploy security agents that monitor Node.js process behavior, specifically flagging unexpected eval() calls, child_process spawns, or network egress during YAML parsing operations.
• Network Segmentation: Isolate applications that process untrusted YAML from critical internal networks. Assume that container escape or lateral movement is possible if the application is compromised.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-76833
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-76833
3. npm Package Page: https://www.npmjs.com/package/@cgauge/yaml
4. CWE-95 (Eval Injection): https://cwe.mitre.org/data/definitions/95.html
5. ATT&CK T1059 (Command and Scripting Interpreter): https://attack.mitre.org/techniques/T1059/

Threat Actor Campaigns: No known active campaigns have been reported at the time of writing. The vulnerability was disclosed without public exploit code and has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the trivial nature of the exploit — a single YAML line invoking eval() — suggests that weaponization will occur rapidly once the package’s adoption becomes more widely known. SOC teams should assume that a public PoC may surface, and treat any process-level pattern matching the Sigma/Elastic rules above as an active incident.

Exploit-in-the-Wild: No confirmed exploitation observed to date. Likelihood of in-the-wild exploitation is rated HIGH given the primitive nature of the flaw and the absence of mitigation options.