Executive brief
gray-matter is a widely-used front matter parser that extracts metadata from documents. By default, it includes a JavaScript engine that uses eval() to execute code in front matter blocks marked with ---js or ---javascript delimiters, allowing attackers to achieve arbitrary code execution when the library processes untrusted input. This enables command execution, file reads, and environment variable access with no user interaction required.
Technical details
The vulnerability exists in lib/engines.js where a JavaScript parser is registered by default using eval() without any language allowlist, allowing users to specify arbitrary languages in the front matter delimiter (e.g., ---js). The language name is extracted from the document itself with no validation, overriding any language option passed by the caller, and arbitrary JavaScript between the delimiters is executed. An attacker only needs to craft a markdown document with ---js at the start; no authentication, network access, or user interaction beyond parsing the document is required.
Affected products
- jonschlinkert gray-matter all versions through 4.0.3
Timeline
- 2026-09-21: disclosed: CVE-2026-78847 published
- 2026-09-14: other: Technical analysis published on Checo's Blog