High, CVSS 8.1npmAmendedPublished
gatsby-transformer-remark has possible unsanitized JavaScript code injection
CVE-2023-22491 · GHSA-7ch4-rr99-cqcw
- Affected
- npm gatsby-transformer-remark >= 6.0.0, < 6.3.2; < 5.25.1
- Fixed in
- 5.25.16.3.2· Vendor fix available
- Issue
- Impact The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present in gatsby-transformer-remark when passing input in data mode (querying MarkdownRemark nodes via GraphQL). Injected JavaScript executes in the context of the build server. To exploit this vulnerability untrusted/unsanitized input would need to be sourced by or added into a file processed by gatsby-transformer-remark. The following payload demonstrates a vulnerable configuration: Patches A patch has been introduced in gatsby-transformer-remark@5.25.1 and gatsby-transformer-remark@6.3.2 which mitigates the issue by disabling the gray-matter JavaScript Frontmatter engine. The patch introduces a new option, JSFrontmatterEngine which is set to false by default. When setting JSFrontmatterEngine to true, input passed to…
Recommended action: Upgrade to 6.3.2 or 5.25.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.