TI-2022-09427 Aliases CVE-2022-25863 GHSA-mj46-r4gr-5x83

Deserialization of untrusted data in gatsby-plugin-mdx

MEDIUM 46CWE-502Published 2022-06-10 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL). Workaround: If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing.

Why it matters now

EPSS 0.01992 80th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed gatsby-plugin-mdx: 2.14.1, 3.15.2gatsby-plugin-mdx (npm): 2.14.1, 3.15.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	gatsby-plugin-mdx	before 2.14.1; 3.0.0 and later; before 3.15.2	2.14.1, 3.15.2	Patch available	CNA
—	gatsby-plugin-mdx (npm)	before 2.14.1	2.14.1	Patch available	GHSA-mj46-r4gr-5x83
—	gatsby-plugin-mdx (npm)	3.0.0 to before 3.15.2	3.15.2	Patch available	GHSA-mj46-r4gr-5x83

gatsby-plugin-mdx Vendor— Affected before 2.14.1; 3.0.0 and later; before 3.15.2 Fixed in 2.14.1, 3.15.2 Patch available CNA
gatsby-plugin-mdx (npm) Vendor— Affected before 2.14.1 Fixed in 2.14.1 Patch available GHSA-mj46-r4gr-5x83
gatsby-plugin-mdx (npm) Vendor— Affected 3.0.0 to before 3.15.2 Fixed in 3.15.2 Patch available GHSA-mj46-r4gr-5x83

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gatsbyjs:gatsby-plugin-mdx::::::node.js::*	before 2.14.1; 3.0.0 to before 3.15.2	Vulnerable	gatsbyjs

cpe:2.3:a:gatsbyjs:gatsby-plugin-mdx:*:*:*:*:*:node.js:*:* Versions before 2.14.1; 3.0.0 to before 3.15.2 Vulnerable ·gatsbyjs

Remediation

Fix · CNA gatsby-plugin-mdx Fixed in 2.14.1, 3.15.2
Fix · GHSA-mj46-r4gr-5x83 gatsby-plugin-mdx (npm) Fixed in 2.14.1 Advisory →
Fix · GHSA-mj46-r4gr-5x83 gatsby-plugin-mdx (npm) Fixed in 3.15.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-25863
2026-10-03 Alias added: GHSA-mj46-r4gr-5x83

References

Exploit 2

Patch 1

https://github.com/gatsbyjs/gatsby/pull/35830/commits/f214eb0694c61e348b2751cecd1aace2046bc46e

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-25863

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences