CVE-2022-25863GHSA-MJ46-R4GR-5X83SNYK-JS-GATSBYPLUGINMDX-2405699
Deserialization of Untrusted Data
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.14.1, 3.15.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL). Workaround: If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a gatsby-plugin-mdx
fixed in 2.14.1; From 3.0.0; fixed in 3.15.2
- gatsby-plugin-mdxnpm
fixed in 2.14.1
- gatsby-plugin-mdxnpm
From 3.0.0 · fixed in 3.15.2