Cgauge Yaml
Monthly
Arbitrary code execution in @cgauge/yaml (all versions ≤ 0.27.0) is achieved by embedding a custom `!js` YAML tag in a document supplied to the parser; the library's tag handler unconditionally passes the tag's string value to `eval()`, granting attackers the full authority of the Node.js runtime - including filesystem access, environment variable exfiltration, network calls, and subprocess spawning. No safe-mode parsing option or opt-out mechanism exists in the library, meaning every call site that parses attacker-controlled YAML is unconditionally vulnerable. A public proof-of-concept exploit is available via GitHub Gist, and no vendor-released patch has been identified at time of analysis.
Arbitrary code execution in @cgauge/yaml (all versions ≤ 0.27.0) is achieved by embedding a custom `!js` YAML tag in a document supplied to the parser; the library's tag handler unconditionally passes the tag's string value to `eval()`, granting attackers the full authority of the Node.js runtime - including filesystem access, environment variable exfiltration, network calls, and subprocess spawning. No safe-mode parsing option or opt-out mechanism exists in the library, meaning every call site that parses attacker-controlled YAML is unconditionally vulnerable. A public proof-of-concept exploit is available via GitHub Gist, and no vendor-released patch has been identified at time of analysis.