Is CVE-2026-78847 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78847 being exploited in the wild.

How severe is CVE-2026-78847?

Critical severity, with a CVSS score of 9.8, published 21 September 2026.

Which products and versions are affected?

Jonschlinkert Gray-Matter all versions through 4.0.3.

Is there a fix for CVE-2026-78847?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-78847 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-78847?

Check whether you run Jonschlinkert Gray-Matter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78847: gray-matter arbitrary code execution via eval in JavaScript engine

CVE-2026-78847 · Severity: critical · CVSS 9.8 · Published 2026-09-21

gray-matter is a widely-used front matter parser that extracts metadata from documents. By default, it includes a JavaScript engine that uses eval() to execute code in front matter blocks marked with ---js or ---javascript delimiters, allowing attackers to achieve arbitrary code execution when the library processes untrusted input. This enables command execution, file reads, and environment variable access with no user interaction required.

Vendors: Jonschlinkert.

Quick answers

Is CVE-2026-78847 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78847 being exploited in the wild.
How severe is CVE-2026-78847?: Critical severity, with a CVSS score of 9.8, published 21 September 2026.
Which products and versions are affected?: Jonschlinkert Gray-Matter all versions through 4.0.3.
Is there a fix for CVE-2026-78847?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78847 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-78847?: Check whether you run Jonschlinkert Gray-Matter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in lib/engines.js where a JavaScript parser is registered by default using eval() without any language allowlist, allowing users to specify arbitrary languages in the front matter delimiter (e.g., ---js). The language name is extracted from the document itself with no validation, overriding any language option passed by the caller, and arbitrary JavaScript between the delimiters is executed. An attacker only needs to craft a markdown document with ---js at the start; no authentication, network access, or user interaction beyond parsing the document is required.

Affected products

jonschlinkert gray-matter all versions through 4.0.3

Timeline

2026-09-21: disclosed: CVE-2026-78847 published
2026-09-14: other: Technical analysis published on Checo's Blog

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.