Deserialization of Untrusted Data Affecting gatsby-plugin-mdx package, versions <2.14.1 >=3.0.0 <3.15.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
- Snyk ID SNYK-JS-GATSBYPLUGINMDX-2405699
- published 6 Jun 2022
- disclosed 18 Feb 2022
- credit Feng Xiao and Zhongfu Su
How to fix?
gatsby-plugin-mdx to version 2.14.1, 3.15.2 or higher.
gatsby-plugin-mdx is a MDX integration for Gatsby
Affected versions of this package are vulnerable to Deserialization of Untrusted Data when passing input through to the
gray-matter package, due to its default configurations that are missing input sanitization.
Exploiting this vulnerability is possible when passing input in both
webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL).
If an older version of
gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing.
const mdxToJsx = require("gatsby-plugin-mdx/utils/mdx.js"); var payload = '---jsn((require("child_process")).execSync("touch rce"))'; mdxToJsx(payload);