Description
The gatsby-plugin-mdx plugin prior to versions 3.15.2 and 2.14.1 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized.
Recommendation
Update the gatsby-plugin-mdx package to the latest compatible version. Followings are version details:
Affected version(s): **>= 3.0.0, < 3.15.2 < 2.14.1** Patched version(s): **3.15.2 2.14.1**
References
Could your website be exposed too?
SmartScanner can check your website for Unsanitized JavaScript code injection possible in gatsby-plugin-mdx and gives you actionable findings to investigate.
Start a free scanRelated Issues
- gatsby-transformer-remark has possible unsanitized JavaScript code injection - CVE-2023-22491
- Improper Control of Generation of Code ('Code Injection') in mdx-mermaid - CVE-2022-36036
- Orval has a code injection via unsanitized x-enum-descriptions in enum generation - CVE-2026-23947
- Orval has Code Injection via unsanitized x-enum-descriptions using JS comments - CVE-2026-25141
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023