Executive Summary

The gatsby-transformer-remark plugin (v5.25.0 and earlier, v6.3.1 and earlier) passes untrusted Markdown input to the gray-matter package, which can execute arbitrary JavaScript in the build server’s context. The flaw is exploitable when unfiltered content is processed via GraphQL queries. Patches in v5.25.1 and v6.3.2 disable gray-matter’s JavaScript frontmatter engine, mitigating the risk. Until upgrading, sanitize all Markdown input before it reaches the plugin. Projects should move to the latest major release to receive security updates.

---

Authoritative CVE Metadata - CVSS Base Score: 8.1 (HIGH) - Published: 2023-01-13T19:15:12.407 - Last Modified: 2026-09-29T15:06:00.643

Original Description: Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present in gatsby-transformer-remark when passing input in data mode (querying MarkdownRemark nodes via GraphQL). Injected JavaScript executes in the context of the build server. To exploit this vulnerability untrusted/unsanitized input would need to be sourced by or added into a file processed by gatsby-transformer-remark. A patch has been introduced in gatsby-transformer-remark@5.25.1 and gatsby-transformer-remark@6.3.2 which mitigates the issue by disabling the gray-matter JavaScript Frontmatter engine. As a workaround, if an older version of gatsby-transformer-remark must be used, input passed into the plugin should be sanitized ahead of processing. It is encouraged for projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.

"It's easier to see the mistakes on someone else's paper."

— Unknown