Homepage
About Snyk

Deserialization of Untrusted Data Affecting gatsby-plugin-mdx package, versions <2.14.1 >=3.0.0 <3.15.2

0.0
high

Snyk CVSS

    Attack Complexity Low
    Confidentiality High
    Integrity High

    Threat Intelligence

    Exploit Maturity Proof of concept
    EPSS 0.61% (79th percentile)
Expand this section
NVD
9.8 critical

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-GATSBYPLUGINMDX-2405699
  • published 6 Jun 2022
  • disclosed 18 Feb 2022
  • credit Feng Xiao and Zhongfu Su
Report a new vulnerability Found a mistake?

Introduced: 18 Feb 2022

CVE-2022-25863 Open this link in a new tab
CWE-502 Open this link in a new tab
First added by Snyk

How to fix?

Upgrade gatsby-plugin-mdx to version 2.14.1, 3.15.2 or higher.

Overview

gatsby-plugin-mdx is a MDX integration for Gatsby

Affected versions of this package are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL).

Workaround:

If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing.

Poc: 

const mdxToJsx = require("gatsby-plugin-mdx/utils/mdx.js");

var payload = '---jsn((require("child_process")).execSync("touch rce"))';

mdxToJsx(payload);