TI-2026-53669 CVE-2026-76833 · GHSA-fqg3-vq72-r4q2
@cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag
Priority HIGH 72
@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() o…