Executive brief
gatsby-transformer-remark is a plugin used by Gatsby (a popular static site generator) to process Markdown files during site builds. The plugin fails to sanitize untrusted input before passing it to the gray-matter library, allowing attackers to inject and execute arbitrary JavaScript code on the build server. This could enable remote code execution, data theft, or compromise of the entire build environment if an attacker can control input files processed by the plugin.
Technical details
The vulnerability is an unsanitized JavaScript code injection flaw in gatsby-transformer-remark versions prior to 5.25.1 and 6.3.2. The plugin passes user input directly to the gray-matter npm package, which has a JavaScript frontmatter engine enabled by default. This engine executes arbitrary JavaScript embedded in frontmatter blocks (e.g., ---js code ---) without sanitization. The attack requires the ability to supply or control input files processed by gatsby-transformer-remark, typically through file uploads or modification of Markdown source files. Injected code executes in the context of the Gatsby build server with full privileges. Patches were released in versions 5.25.1 and 6.3.2, which disable the JavaScript frontmatter engine by default via a new JSFrontmatterEngine option set to false.
Affected products
- Gatsby gatsby-transformer-remark <5.25.1, 6.0.0-6.3.1
Timeline
- 2023-01-11: disclosed: GHSA-7ch4-rr99-cqcw published
- 2023-01-11: patched: Patches released in versions 5.25.1 and 6.3.2