Description
The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized.
Recommendation
Update the gatsby-transformer-remark package to the latest compatible version. Followings are version details:
Affected version(s): **< 5.25.1 >= 6.0.0, < 6.3.2** Patched version(s): **5.25.1 6.3.2**
References
Could your website be exposed too?
SmartScanner can check your website for gatsby-transformer-remark has possible unsanitized JavaScript code injection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Unsanitized JavaScript code injection possible in gatsby-plugin-mdx - CVE-2022-25863
- OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts - CVE-2026-48054
- Orval has a code injection via unsanitized x-enum-descriptions in enum generation - CVE-2026-23947
- Orval has Code Injection via unsanitized x-enum-descriptions using JS comments - CVE-2026-25141
You might also like:
See something that needs correcting? Let us knowUpdated January 23, 2023