Vulnerabilities

TI-2023-17074 CVE-2023-34238 · GHSA-c6f8-8r25-c4gc

Local File Inclusion vulnerability in Gatsby

LOW 26

Gatsby is a free and open source framework based on React.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0091 Published 2023-06-07 Fixed in 5.9.1, 4.25.7 CWE-22

TI-2023-14383 CVE-2023-30548 · GHSA-h2pm-378c-pcxx

Path traversal vulnerability in gatsby-plugin-sharp

MEDIUM 53

gatsby-plugin-sharp is a plugin for the gatsby framework which exposes functions built on the Sharp image processing library.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00882 Published 2023-04-17 Fixed in 4.25.1, 5.8.1 CWE-22

TI-2023-08740 CVE-2023-22491 · GHSA-7ch4-rr99-cqcw

gatsby-transformer-remark vulnerable to unsanitized JavaScript code injection

HIGH 70

Gatsby is a free and open source framework based on React that helps developers build websites and apps.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00578 Published 2023-01-13 Fixed in 6.3.2, 5.25.1 CWE-20

TI-2022-09427 CVE-2022-25863 · GHSA-mj46-r4gr-5x83

Deserialization of untrusted data in gatsby-plugin-mdx

MEDIUM 46

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01992 Published 2022-06-10 Fixed in 2.14.1, 3.15.2 CWE-502

TI-2021-12437 CVE-2021-32770 · GHSA-rqjw-p5vr-c695

Basic-auth app bundle credential exposure in gatsby-source-wordpress

LOW 36

Gatsby is a framework for building websites.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01414 Published 2021-07-15 Fixed in 4.0.8, 5.9.2 CWE-200