CVE-2026-78847: Npm/gray-matter vulnerability
An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
When is an application exposed to arbitrary code execution?
An application is exposed when it uses gray-matter to parse front matter declared with the js or javascript language, because the affected engine evaluates that content with eval().
What input must an attacker control to exploit this issue?
The attacker needs the ability to supply or modify content whose front matter is parsed by gray-matter with language set to js or javascript. The provided information does not establish whether any particular application accepts such content from untrusted users by default.
Which versions are affected?
The issue is described as affecting all versions of gray-matter and was verified on version 4.0.3.
How can I identify potentially affected use in my environment?
Identify installations of the npm package gray-matter, then review whether they parse front matter using the js or javascript language. Such parsing reaches the JavaScript engine in lib/engines.js that uses eval().