CVE-2022-25863 Details
Description
The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL). Workaround: If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing.
A vulnerability allowing deserialization of untrusted data has been identified in the Gatsby plugin MDX, specifically in versions prior to 2.14.1, from 3.0.0, and prior to 3.15.2. This vulnerability arises from the plugin's default configuration, which lacks proper input sanitization, allowing maliciously crafted frontmatter to be executed as JavaScript. The issue can be exploited in both webpack and data modes, such as when MDX files are processed as components in React or queried via GraphQL. A proof-of-concept demonstrating the vulnerability is available.
Users should upgrade to Gatsby plugin MDX versions 2.14.1, 3.15.2 or higher. If an upgrade is not possible, input passed to the plugin should be sanitized before processing.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://drive.google.com/file/d/1EoCzbwTWOM8-fjvwMbH3bqcZ2iKksxTW/view?usp=sharing | CVE | ExploitThird Party Advisory |
| https://github.com/gatsbyjs/gatsby/pull/35830 | CVE | ExploitPatchThird Party Advisory |
| https://github.com/gatsbyjs/gatsby/pull/35830/commits/f214eb0694c61e348b2751cecd1aace2046bc46e | CVE | PatchThird Party Advisory |
| https://snyk.io/vuln/SNYK-JS-GATSBYPLUGINMDX-2405699 | CVE | ExploitThird Party Advisory |
| https://drive.google.com/file/d/1EoCzbwTWOM8-fjvwMbH3bqcZ2iKksxTW/view?usp=sharing | [email protected] | ExploitThird Party Advisory |
| https://github.com/gatsbyjs/gatsby/pull/35830 | [email protected] | ExploitPatchThird Party Advisory |
| https://github.com/gatsbyjs/gatsby/pull/35830/commits/f214eb0694c61e348b2751cecd1aace2046bc46e | [email protected] | PatchThird Party Advisory |
| https://snyk.io/vuln/SNYK-JS-GATSBYPLUGINMDX-2405699 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gatsbyjs gatsby | < 2.14.1 >= 3.0.0, < 3.15.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Jun 17, 2022 | Initial Analysis | [email protected] |
| Jun 10, 2022 | CVE Modified | [email protected] |