// For flags

CVE-2022-25863

Deserialization of Untrusted Data

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

3
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL). Workaround: If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing.

El paquete gatsby-plugin-mdx versiones anteriores a 2.14.1, a partir de la 3.0.0 y anteriores a 3.15.2, es vulnerable a una Deserialización de Datos No Confiables cuando es pasada la entrada mediante el paquete gray-matter, debido a sus configuraciones por defecto que carecen de saneo de entrada. La explotación de esta vulnerabilidad es posible cuando es pasada la entrada tanto en modo webpack (archivos MDX en src/pages o archivo MDX importado como componente en código frontend / React) como en modo datos (consulta de nodos MDX por medio de GraphQL). Mitigación: Si es debido usar una versión anterior de gatsby-plugin-mdx, la entrada que es pasada al plugin debe ser saneada antes del procesamiento

*Credits: Feng Xiao and Zhongfu Su
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-02-24 CVE Reserved
  • 2022-06-10 CVE Published
  • 2024-09-01 EPSS Updated
  • 2024-09-17 CVE Updated
  • 2024-09-17 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-502: Deserialization of Untrusted Data
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Gatsbyjs
Search vendor "Gatsbyjs"
 Gatsby
Search vendor "Gatsbyjs" for product "Gatsby"
 < 2.14.1
Search vendor "Gatsbyjs" for product "Gatsby" and version " < 2.14.1"
node.js
Affected
Gatsbyjs
Search vendor "Gatsbyjs"
 Gatsby
Search vendor "Gatsbyjs" for product "Gatsby"
 >= 3.0.0 < 3.15.2
Search vendor "Gatsbyjs" for product "Gatsby" and version " >= 3.0.0 < 3.15.2"
node.js
Affected