CVE-2023-22491

Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the `gray-matter` npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present in gatsby-transformer-remark when passing input in data mode (querying MarkdownRemark nodes via GraphQL). Injected JavaScript executes in the context of the build server. To exploit this vulnerability untrusted/unsanitized input would need to be sourced by or added into a file processed by gatsby-transformer-remark. A patch has been introduced in `gatsby-transformer-remark@5.25.1` and `gatsby-transformer-remark@6.3.2` which mitigates the issue by disabling the `gray-matter` JavaScript Frontmatter engine. As a workaround, if an older version of `gatsby-transformer-remark` must be used, input passed into the plugin should be sanitized ahead of processing. It is encouraged for projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.

• CWE-20
• CWE-89
• CWE-79

• https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcwExploit, Third Party Advisory
• https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcwExploit, Third Party Advisory
• https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcwExploit, Third Party Advisory

Published

Jan 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22486cmark-gfm is GitHub's fork of cmark, a CommonMark parsing an…7.5
• CVE-2023-22487Flarum is a forum software for building communities. Using t…4.3
• CVE-2023-22488Flarum is a forum software for building communities. Using t…5.4
• CVE-2023-22489Flarum is a discussion platform for websites. If the first p…3.5
• CVE-2023-2249The wpForo Forum plugin for WordPress is vulnerable to Local…8.8
• CVE-2023-22490Git is a revision control system. Using a specially-crafted …5.5
• CVE-2023-22492ZITADEL is a combination of Auth0 and Keycloak. RefreshToken…5.9
• CVE-2023-22493RSSHub is an open source RSS feed generator. RSSHub is vulne…7.5
• CVE-2023-22494Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-22495Izanami is a shared configuration service well-suited for mi…9.8
• CVE-2023-22496Netdata is an open source option for real-time infrastructur…9.8
• CVE-2023-22497Netdata is an open source option for real-time infrastructur…9.1