9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.006 Low
EPSS
Percentile
78.5%
The gatsby-plugin-mdx plugin prior to versions 3.15.2 and 2.14.1 passes input through to the gray-matter
npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present when passing input in both webpack (MDX files in src/pages
or MDX file imported as component in frontend / React code) and data mode (querying MDX nodes via GraphQL). Injected JavaScript executes in the context of the build server.
To exploit this vulnerability untrusted/unsanitized input would need to be sourced or added into an MDX file. The following MDX payload demonstrates a vulnerable configuration:
---js
((require("child_process")).execSync("id >> /tmp/rce"))
---
A patch has been introduced in [email protected]
and [email protected]
which mitigates the issue by disabling the gray-matter
JavaScript Frontmatter engine. The patch introduces a new option, JSFrontmatterEngine
which is set to false
by default. When setting JSFrontmatterEngine
to true
, input passed to gatsby-plugin-mdx
must be sanitized before processing to avoid a security risk. Warnings are displayed when enabling JSFrontmatterEngine
to true
or if it appears that the MDX input is attempting to use the Frontmatter engine.
If an older version of gatsby-plugin-mdx
must be used, input passed into the plugin should be sanitized ahead of processing.
We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.
We would like to thank Snyk [snyk.io] for initially bringing the issue to our attention, as well as Feng Xiao and Zhongfu Su, who reported the issue to Snyk.
Email us at [email protected].
CPE | Name | Operator | Version |
---|---|---|---|
gatsby-plugin-mdx | lt | 3.15.2 | |
gatsby-plugin-mdx | lt | 2.14.1 |
drive.google.com/file/d/1EoCzbwTWOM8-fjvwMbH3bqcZ2iKksxTW/view?usp=sharing
github.com/advisories/GHSA-mj46-r4gr-5x83
github.com/gatsbyjs/gatsby/pull/35830
github.com/gatsbyjs/gatsby/pull/35830/commits/f214eb0694c61e348b2751cecd1aace2046bc46e
github.com/gatsbyjs/gatsby/security/advisories/GHSA-mj46-r4gr-5x83
nvd.nist.gov/vuln/detail/CVE-2022-25863
snyk.io/vuln/SNYK-JS-GATSBYPLUGINMDX-2405699
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.006 Low
EPSS
Percentile
78.5%