Description

An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-21T22:16:58.863Z",
  "pubdate": "2026-09-21T22:16:58.863Z",
  "executiveSummary": "The gray-matter library is susceptible to a Remote Code Execution (RCE) vulnerability stemming from the unsafe evaluation of user-supplied front matter.\nThe vulnerability type is classified as insecure code execution due to the use of eval() on untrusted input.\nAffected product: gray-matter (All versions, verified on 4.0.3).\nImpact includes complete system compromise, as an attacker can execute arbitrary JavaScript within the context of the Node.js application process.\nRisk implications are critical, as any application utilizing gray-matter to process untrusted front matter is potentially exposed to full server-side command execution.\nAttacker capabilities involve the ability to inject malicious payloads into document front matter, which, when parsed by the library, triggers the execution of the injected code.\nExploitation requirements include the application's configuration permitting 'js' or 'javascript' as valid front matter languages, which invokes the vulnerable execution path.\nThis issue bypasses standard sandboxing as it leverages the host process's JavaScript environment directly.",
  "technicalDetails": "The vulnerability resides in lib/engines.js within the gray-matter library. The component is responsible for parsing front matter content based on defined language specifications.\nThe root cause is the utilization of the native JavaScript eval() function to parse front matter when the language attribute is set to 'js' or 'javascript'.\nWhen an application processes an input document, gray-matter checks the defined language for the front matter block. If the language is specified as JavaScript, the library passes the content directly to the eval() function without sanitization or sandboxing.\nThe attack flow proceeds as follows: 1) An attacker crafts a document containing front matter marked as 'js' or 'javascript'. 2) Inside this front matter block, the attacker embeds malicious JavaScript code. 3) The target application invokes gray-matter to parse the document. 4) gray-matter detects the language type and reaches the insecure code path in lib/engines.js. 5) The eval() function executes the attacker's payload within the host Node.js process.\nThe execution occurs with the same privileges as the user running the Node.js application, granting the attacker access to the file system, network, and environment variables.\nBecause eval() executes in the local scope, the payload can access global objects and perform arbitrary actions, such as spawning shell processes, exfiltrating configuration files, or establishing persistent backdoors.\nAffected versions include all versions of gray-matter up to and including 4.0.3. The vulnerability does not require authentication to the application itself, as the exploit is triggered during the data processing phase of the application's workflow.\nThe exposure is dependent on the application's willingness to process user-provided documents containing front matter. No specialized privileges are required to inject the payload, making this an ideal target for Remote Code Execution in content management systems, static site generators, or document processing pipelines that rely on gray-matter."
}