Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-78847: gray-matter can run unwanted code when processing JS front matter
CVE-2026-78847 · published 28 days ago
Summary
If your application uses gray-matter to read front‑matter and allows the language to be set to JavaScript, the library may execute that code automatically. This could let an attacker run arbitrary commands on your server. Update to the latest version or configure the library to reject JavaScript as a front‑matter language to prevent this behavior.
Original advisory text
An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code ...
An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code execution.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Timeline
Published21 Sep 2026
Updated19 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta