Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the `gray-matter` npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present in gatsby-transformer-remark when passing input in data mode (querying MarkdownRemark nodes via GraphQL). Injected JavaScript executes in the context of the build server. To exploit this vulnerability untrusted/unsanitized input would need to be sourced by or added into a file processed by gatsby-transformer-remark. A patch has been introduced in `gatsby-transformer-remark@5.25.1` and `gatsby-transformer-remark@6.3.2` which mitigates the issue by disabling the `gray-matter` JavaScript Frontmatter engine. As a workaround, if an older version of `gatsby-transformer-remark` must be used, input passed into the plugin should be sanitized ahead of processing. It is encouraged for projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Gatsby is a free and open source framework based on React that helps developers build websites and apps.
    The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the `gray-     matter` npm package, which is vulnerable to JavaScript injection in its default configuration, unless     input is sanitized. The vulnerability is present in gatsby-transformer-remark when passing input in data     mode (querying MarkdownRemark nodes via GraphQL). Injected JavaScript executes in the context of the build     server. To exploit this vulnerability untrusted/unsanitized input would need to be sourced by or added     into a file processed by gatsby-transformer-remark. A patch has been introduced in `gatsby-transformer-     remark@5.25.1` and `gatsby-transformer-remark@6.3.2` which mitigates the issue by disabling the `gray-     matter` JavaScript Frontmatter engine. As a workaround, if an older version of `gatsby-transformer-remark`     must be used, input passed into the plugin should be sanitized ahead of processing. It is encouraged for     projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest     security updates and bug fixes are received in a timely manner. (CVE-2023-22491)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Gatsby is a free and open source framework based on React that helps developers build websites and apps.
    The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the `gray-
    matter` npm package, which is vulnerable to JavaScript injection in its default configuration, unless
    input is sanitized. The vulnerability is present in gatsby-transformer-remark when passing input in data
    mode (querying MarkdownRemark nodes via GraphQL). Injected JavaScript executes in the context of the build
    server. To exploit this vulnerability untrusted/unsanitized input would need to be sourced by or added
    into a file processed by gatsby-transformer-remark. A patch has been introduced in `gatsby-transformer-
    remark@5.25.1` and `gatsby-transformer-remark@6.3.2` which mitigates the issue by disabling the `gray-
    matter` JavaScript Frontmatter engine. As a workaround, if an older version of `gatsby-transformer-remark`
    must be used, input passed into the plugin should be sanitized ahead of processing. It is encouraged for
    projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest
    security updates and bug fixes are received in a timely manner. (CVE-2023-22491)

ID	Name	Product	Family	Severity
253085	Linux Distros Unpatched Vulnerability : CVE-2023-22491	Nessus	Misc.	medium
411996	SCA: security update for gatsby-transformer-remark (GHSA-7ch4-rr99-cqcw)	Tenable Cloud Security	SCA Checks	medium
411996	SCA: security update for gatsby-transformer-remark (GHSA-7ch4-rr99-cqcw)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2023-22491

medium

Tenable Plugins

medium

medium

medium