{"id":"EUVD-2022-6094","enisaUuid":"129076c1-a9cf-3ff0-aa00-38718d40d405","description":"The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL). Workaround: If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing.","datePublished":"Jun 10, 2022, 8:00:19 PM","dateUpdated":"Sep 17, 2024, 12:31:34 AM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P","references":"https://snyk.io/vuln/SNYK-JS-GATSBYPLUGINMDX-2405699\nhttps://drive.google.com/file/d/1EoCzbwTWOM8-fjvwMbH3bqcZ2iKksxTW/view?usp\u003dsharing\nhttps://github.com/gatsbyjs/gatsby/pull/35830\nhttps://github.com/gatsbyjs/gatsby/pull/35830/commits/f214eb0694c61e348b2751cecd1aace2046bc46e\n","aliases":"CVE-2022-25863\nGHSA-mj46-r4gr-5x83\n","assigner":"snyk","epss":1.96,"enisaIdProduct":[{"id":"11f47a9c-e7ca-384e-b194-800e50f643ea","product":{"name":"gatsby-plugin-mdx","vendor":{"name":"n/a"}},"product_version":"3.0.0 \u003cunspecified"},{"id":"3afaab5f-b999-3fe7-9e97-53fd41db0be9","product":{"name":"gatsby-plugin-mdx","vendor":{"name":"n/a"}},"product_version":"unspecified \u003c2.14.1"},{"id":"eab22605-40cb-39b6-bdf6-3ef820755f24","product":{"name":"gatsby-plugin-mdx","vendor":{"name":"n/a"}},"product_version":"unspecified \u003c3.15.2"}],"enisaIdVendor":[{"id":"5a53886d-c0fc-3c43-b7de-cd9712e5c80f","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"20cdaba5-7e70-3b18-b7fd-86cf2134021c","vulnerability":{"id":"GHSA-mj46-r4gr-5x83","description":"Unsanitized JavaScript code injection possible in gatsby-plugin-mdx","datePublished":"Jun 3, 2022, 10:32:06 PM","dateUpdated":"Jun 6, 2022, 6:59:37 PM","baseScore":null,"references":"https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-mj46-r4gr-5x83\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-25863\nhttps://github.com/gatsbyjs/gatsby/pull/35830\nhttps://github.com/gatsbyjs/gatsby/pull/35830/commits/f214eb0694c61e348b2751cecd1aace2046bc46e\nhttps://drive.google.com/file/d/1EoCzbwTWOM8-fjvwMbH3bqcZ2iKksxTW/view?usp\u003dsharing\nhttps://github.com/gatsbyjs/gatsby\nhttps://snyk.io/vuln/SNYK-JS-GATSBYPLUGINMDX-2405699\n","enisa_id":"EUVD-2022-6094\n","aliases":"CVE-2022-25863\nGHSA-mj46-r4gr-5x83\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:05:06 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"4cdd8176-1ba1-36d3-b985-dd2bfccf0537","vulnerability":{"id":"CVE-2022-25863","description":"The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL). Workaround: If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing.","datePublished":"Jun 10, 2022, 8:00:19 PM","dateUpdated":"Sep 17, 2024, 12:31:34 AM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P","references":"https://snyk.io/vuln/SNYK-JS-GATSBYPLUGINMDX-2405699\nhttps://drive.google.com/file/d/1EoCzbwTWOM8-fjvwMbH3bqcZ2iKksxTW/view?usp\u003dsharing\nhttps://github.com/gatsbyjs/gatsby/pull/35830\nhttps://github.com/gatsbyjs/gatsby/pull/35830/commits/f214eb0694c61e348b2751cecd1aace2046bc46e\n","enisa_id":"EUVD-2022-6094\n","assigner":"snyk","epss":1.96,"dataProcessed":"Oct 28, 2026, 7:14:15 AM","vulnerabilityProduct":[{"id":"180d1e25-3ab7-31c6-9186-df002ee069f4","product":{"name":"gatsby-plugin-mdx","vendor":{"name":"n/a"}},"product_version":"unspecified \u003c2.14.1"},{"id":"447a81e6-c69e-3e08-bbfc-b4f4076d7682","product":{"name":"gatsby-plugin-mdx","vendor":{"name":"n/a"}},"product_version":"3.0.0 \u003cunspecified"},{"id":"b5fb78cc-a747-3684-9a2d-0b04d2d10556","product":{"name":"gatsby-plugin-mdx","vendor":{"name":"n/a"}},"product_version":"unspecified \u003c3.15.2"}],"vulnerabilityVendor":[{"id":"a9f74339-ce77-3fe0-846e-18cd31ceba73","vendor":{"name":"n/a"}}]}}],"enisaIdAdvisory":[]}