Executive brief
gatsby-plugin-mdx is a plugin that processes Markdown files for Gatsby static site generators. An attacker who can inject untrusted content into MDX files can execute arbitrary JavaScript code during the site build process, potentially leading to remote code execution on the build server and unauthorized access to sensitive build-time data.
Technical details
The vulnerability is a JavaScript code injection flaw in gatsby-plugin-mdx versions prior to 2.14.1 and 3.15.2. The plugin passes untrusted input to the gray-matter npm package with JavaScript frontmatter parsing enabled by default, allowing arbitrary code execution. The vulnerable component is the gray-matter JavaScript Frontmatter engine, which is invoked when processing MDX frontmatter. Exploitation requires the ability to add or modify MDX file content (either in src/pages or imported components), and JavaScript executes in the build server context. Patches were released in gatsby-plugin-mdx@2.14.1 and @3.15.2, which disable the JavaScript Frontmatter engine by default and introduce a JSFrontmatterEngine option.
Affected products
- Gatsby gatsby-plugin-mdx < 2.14.1 and 3.0.0 to < 3.15.2
Timeline
- 2022-06-03: disclosed
- 2022-06-03: patched: gatsby-plugin-mdx@2.14.1 and @3.15.2 released