CVE-2026-78847

Published: Sep 21, 2026Modified: Sep 22, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code execution.

Related CWEs

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

References (5)

https://blog.checo.cc/en/posts/Security/1

Source: cve@mitre.org

https://github.com/jonschlinkert/gray-matter/issues/112

Source: cve@mitre.org

https://github.com/jonschlinkert/gray-matter/issues/131

Source: cve@mitre.org

https://github.com/jonschlinkert/gray-matter/issues/182

Source: cve@mitre.org

https://github.com/jonschlinkert/gray-matter/issues/182

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.