CVE-2022-25863

Katalog CVE

CVSS 9.8 · Critical EPSS 2,0%

Kerentanan Deserialization of Untrusted Data pada gatsbyjs gatsby-plugin-mdx. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL). Workaround: If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing.

Rincian

Terbit di NVD

10 Juni 2022

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 79,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gatsbyjs/gatsby/pull/35830 exploit · patch · advisory pihak ketiga
• https://github.com/gatsbyjs/gatsby/pull/35830/commits/f214eb0694c61e348b2751cecd1aace2046bc46e patch · advisory pihak ketiga
• https://drive.google.com/file/d/1EoCzbwTWOM8-fjvwMbH3bqcZ2iKksxTW/view?usp=sharing exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-GATSBYPLUGINMDX-2405699 exploit · advisory pihak ketiga