Executive brief
post-loader is a webpack loader that processes Markdown blog posts and extracts metadata and content. The loader unsafely evaluates JavaScript code embedded within Markdown files, allowing an attacker to execute arbitrary code during the build process. This could compromise the integrity of built applications and expose sensitive build-time secrets.
Technical details
post-loader contains an arbitrary code execution vulnerability (CWE-79) caused by unsafe use of a markdown parser that evaluates embedded JavaScript code without sanitization. The vulnerability affects all versions from 0.0.0 onward. An attacker who can control Markdown input files processed by post-loader (e.g., via a compromised blog post or supply-chain attack) can inject malicious JavaScript that will execute during webpack's build phase. No precondition authentication is required beyond the ability to provide markdown input. No patch or workaround was available at the time of advisory publication.
Affected products
- post-loader 0.0.0 and later
Timeline
- 2022-03-18: disclosed: GHSA advisory published
- 2022-03-17: other: NVD entry published