Based on the description, it is inferred that the @cgauge/yaml package contains a flaw that lets attackers execute arbitrary JavaScript code by including the custom !js YAML tag, which triggers eval() on the supplied string during parsing. This flaw effectively grants full Node.js runtime authority over any process that edits its YAML, enabling file read/write, environment manipulation, network connections, and spawning subprocesses. No safe-mode or opt-out mechanism exists, so any untrusted input processed with this library risks critical system compromise.

Based on the description, it is inferred that the vulnerability affects the cgauge:@cgauge/yaml package, used in any Node.js application that imports this npm module regardless of version because the issue resides in the core YAML parser logic. No specific version range is provided, so all released iterations are potentially exposed until a fixed version is rolled out. Systems that rely on this package to parse external YAML—from configuration files to third‑party data—are at risk.

Based on the description, the likely attack vector is the injection of a crafted YAML document containing a !js tag, which triggers eval() in the victim's Node.js environment. The CVSS score of 8.4 indicates high severity, and while an EPSS value is unavailable, the absence of a KEV listing suggests no confirmed widespread exploitation yet. Since the flaw is trivial to trigger via any input source, the likelihood of exploitation remains significant in environments that ingest user‑controlled YAML.