Deserialization of Untrusted Data Affecting gatsby-plugin-mdx package, versions <2.14.1 >=3.0.0 <3.15.2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-GATSBYPLUGINMDX-2405699
- published 6 Jun 2022
- disclosed 18 Feb 2022
- credit Feng Xiao and Zhongfu Su
Introduced: 18 Feb 2022
CVE-2022-25863 Open this link in a new tabHow to fix?
Upgrade gatsby-plugin-mdx to version 2.14.1, 3.15.2 or higher.
Overview
gatsby-plugin-mdx is a MDX integration for Gatsby
Affected versions of this package are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization.
Exploiting this vulnerability is possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL).
Workaround:
If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing.
Poc:
const mdxToJsx = require("gatsby-plugin-mdx/utils/mdx.js");
var payload = '---jsn((require("child_process")).execSync("touch rce"))';
mdxToJsx(payload);