CyberRota Analysis
AI-GeneratedThe @cgauge/yaml npm package is vulnerable to arbitrary code execution due to its handling of custom !js YAML tags, which allow attackers to execute arbitrary JavaScript through the eval() function during document parsing. This vulnerability grants full Node.js runtime access, enabling potential manipulation of environment variables, filesystem operations, network access, and subprocess execution. Developers and organizations utilizing this package in applications that parse untrusted YAML input should prioritize immediate remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during document parsing. Any application parsing untrusted YAML input with this library exposes full Node.js runtime authority, including environment variable access, filesystem read/write, network access, and subprocess execution, with no safe-mode alternative or opt-out mechanism available.