Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

1 record

Vendor: cgauge Clear all filters
TI-2026-53669 CVE-2026-76833 · GHSA-fqg3-vq72-r4q2

@cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag

Priority HIGH 72

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() o…

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00219 Published 2026-08-20 No fix listed CWE-95