Gatsby develop server has Local File Inclusion vulnerability

Description

The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the __file-code-frame and __original-stack-frame paths, exposed when running the Gatsby develop server (gatsby develop).

Recommendation

Update the gatsby package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.0.0, <= 5.9.0

  <= 4.25.6**

• Patched version(s): **5.9.1

  4.25.7**

References

• GHSA-c6f8-8r25-c4gc
• CVE-2023-34238
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• jsPDF has Local File Inclusion/Path Traversal vulnerability - CVE-2025-68428
• FUXA vulnerable to Local File Inclusion - CVE-2023-31716
• Arbitrary local file read vulnerability during template rendering - swig-templates - CVE-2023-25345
• Arbitrary local file read vulnerability during template rendering - CVE-2023-25345

You might also like:

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

gatsby