CVE-2022-36036

**Summary**CVE-2022-36036 affects the mdx-mermaid component, enabling arbitrary JavaScript injection by placing code into mermaid blocks. Versions affected: < 1.3.0 and

CVE-2022-36036 Improper Control of Generation of Code ('Code Injection') in mdx-mermaid

mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less than 1.3.0 and 2.0.0-rc1. Modify any mermaid code blocks with arbitrary code and it will execute when the component is loaded by MDXjs. This vulnerability was...

CVE-2022-36036 Improper Control of Generation of Code ('Code Injection') in mdx-mermaid

mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less than 1.3.0 and 2.0.0-rc1. Modify any mermaid code blocks with arbitrary code and it will execute when the component is loaded by MDXjs. This vulnerability was...

PT-2022-23132 · Unknown · Mdx-Mermaid

Name of the Vulnerable Software and Affected Versions: mdx-mermaid versions less than 1.3.0 mdx-mermaid versions 2.0.0-rc1 Description: The issue concerns an arbitrary JavaScript injection potential in mdx-mermaid. This can be exploited by modifying mermaid code blocks with arbitrary code, which...

Deserialization Of Untrusted Data

gatsby-plugin-mdx is vulnerable to deserialization of untrusted data. The vulnerability exists when passing input into grey-matter because the default configuration doesn't properly sanitize the input which allows an attacker to bypass and inject untrusted input into MDX files...

CVE-2022-25863

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible whe...

Deserialization of untrusted data

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible whe...

CVE-2022-25863 Deserialization of Untrusted Data

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible whe...

CVE-2022-25863 Deserialization of Untrusted Data

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible whe...

CVE-2022-25863

The CVE concerns gatsby-plugin-mdx vulnerable to Deserialization of Untrusted Data when passing input to the gray-matter component. Affected ranges include versions before 2.14.1, from 3.0.0 up to before 3.15.2. The issue arises from default configurations that do not sanitize input, allowing unt...

CVE-2022-25863

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible whe...

gatsby 代码问题漏洞

gatsby is a software application. A free open source framework based on React that helps developers build extremely fast websites and applications. A security vulnerability exists in the gatsby plugin mdx versions 2.14.1 and earlier, 3.15.2 and earlier, which stems from vulnerability to...

Arbitrary Code Injection

gatsby-plugin-mdx is vulnerable to arbitrary code injection. The vulnerability exists because the gatsby-plugin-mdx allows JS engine for frontmatter by default due to untrusted inputs which allows an attacker to inject arbitrary codes...

@commercetools-docs/gatsby-theme-docs (>=0.0.0-canary-20211016203612, <=17.0.9), @zedvision/blog (>=14.0.1, <=14.3.6) +1 more potentially affected by CVE-2022-25863 via gatsby-plugin-mdx (>=2.0.0, <=2.14.0)

gatsby-plugin-mdx NPM version =2.0.0, =0.0.0-canary-20211016203612, =14.0.1, =13.0.5, =14.0.0 Source cves: CVE-2022-25863 Source advisory: OSV:GHSA-MJ46-R4GR-5X83...

@commercetools-docs/gatsby-theme-docs (>=0.0.0-canary-20211022203039, <=19.1.0), @dcl/docs-site (>=1.0.0-3010867520.commit-1740972, <=1.0.0-20220919140413.commit-6dee65c) +5 more potentially affected by CVE-2022-25863 via gatsby-plugin-mdx (>=3.2.0, <=3.13.0)

gatsby-plugin-mdx NPM version =3.2.0, =0.0.0-canary-20211022203039, =1.0.0-3010867520.commit-1740972, =1.1.1, =1.18.5, =1.0.2, =1.0.8 - gatsby.webstackbuilders.com 0.1.0 Source cves: CVE-2022-25863 Source advisory: OSV:GHSA-MJ46-R4GR-5X83...

GHSA-MJ46-R4GR-5X83 Unsanitized JavaScript code injection possible in gatsby-plugin-mdx

Impact The gatsby-plugin-mdx plugin prior to versions 3.15.2 and 2.14.1 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present when passing input in both webpack MDX fil...

@commercetools-docs/gatsby-theme-docs (>=0.0.0-canary-20211016203612, <=17.0.9), @zedvision/blog (>=14.0.1, <=14.3.6) +1 more potentially affected by CVE-2022-25863 via gatsby-plugin-mdx (>=2.0.0, <=2.14.0)

gatsby-plugin-mdx NPM version =2.0.0, =0.0.0-canary-20211016203612, =14.0.1, =13.0.5, =14.0.0 Source cves: CVE-2022-25863 Source advisory: SNYK:JS-GATSBYPLUGINMDX-2405699...

@commercetools-docs/gatsby-theme-docs (>=0.0.0-canary-20211022203039, <=19.1.0), @dcl/docs-site (>=1.0.0-3010867520.commit-1740972, <=1.0.0-20220919140413.commit-6dee65c) +5 more potentially affected by CVE-2022-25863 via gatsby-plugin-mdx (>=3.2.0, <=3.13.0)

gatsby-plugin-mdx NPM version =3.2.0, =0.0.0-canary-20211022203039, =1.0.0-3010867520.commit-1740972, =1.1.1, =1.18.5, =1.0.2, =1.0.8 - gatsby.webstackbuilders.com 0.1.0 Source cves: CVE-2022-25863 Source advisory: SNYK:JS-GATSBYPLUGINMDX-2405699...

Deserialization of Untrusted Data

Overview gatsby-plugin-mdx is a MDX integration for Gatsby Affected versions of this package are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this...

MAM SDK Migration Unexpected behavior on MDX/MAM SDK app container

Some interaction between managed applications in the same container are not working properly for example, copy and paste, open-in, etc. Scenario 1: Productivity Apps only using Hybrid mode One app on Legacy MDX and one app on MAM SDK. This scenario is not supported and not recommended. Scenario 2...