Security consideration: disable JS engine by default to prevent RCEs in dependents

simonhaenisch commented

2021-09-28 07:48:27 +00:00

(Migrated from github.com)

I created a remote code execution (RCE) vulnerability in a package of mine (see https://github.com/simonhaenisch/md-to-pdf/issues/99) because I was somehow not aware that gray-matter was able to parse JS as well, and that it was enabled by default.

A few years back I simply used gray-matter in my tool md-to-pdf to parse YAML front-matter without going through the whole docs (initially this was a personal project for writing assignments). My package ended up being used on dillinger.io (web-based markdown editor) for PDF exports, and thus you could execute code on their server by adding a front-matter that started with ---js (i. e., dynamic language detection would kick in). To fix it, I overwrote the js engine in the gray-matter options, and users can provide custom gray-matter options if they want it back.

BTW this has also been somewhat discussed in #112 but the goal of this ticket is different. I'm suggesting that the JS engine is disabled by default, and only works if you explicitly set language: 'js' in the options. I know this will be a breaking change but I can imagine there would be other packages out there that run on servers and use gray-matter to parse user-provided content, and not all of them might have been aware of this JS parsing feature either.

IMO the responsibility is usually on the package user because you should never trust user-provided content, however in this case it's easy to prevent developer mistakes by making this an actual opt-in option (instead of already opted-in by default).

I created a remote code execution (RCE) vulnerability in a package of mine (see https://github.com/simonhaenisch/md-to-pdf/issues/99) because I was somehow not aware that gray-matter was able to parse JS as well, and that it was enabled by default. A few years back I simply used gray-matter in my tool `md-to-pdf` to parse YAML front-matter without going through the whole docs (initially this was a personal project for writing assignments). My package ended up being used on [dillinger.io](https://dillinger.io) (web-based markdown editor) for PDF exports, and thus you could execute code on their server by adding a front-matter that started with `---js` (i. e., dynamic language detection would kick in). To fix it, I overwrote the `js` engine in the gray-matter options, and users can provide custom gray-matter options if they want it back. BTW this has also been somewhat discussed in #112 but the goal of this ticket is different. I'm suggesting that the JS engine is disabled by default, and only works if you explicitly set `language: 'js'` in the options. I know this will be a breaking change but I can imagine there would be other packages out there that run on servers and use gray-matter to parse user-provided content, and not all of them might have been aware of this JS parsing feature either. IMO the responsibility is usually on the package user because you should never trust user-provided content, however in this case it's easy to prevent developer mistakes by making this an actual opt-in option (instead of already opted-in by default).

👍 7

segevfiner commented

2023-04-20 19:26:30 +00:00

(Migrated from github.com)

This should really not be enabled by default...

cristianstaicu commented

2025-11-22 12:11:09 +00:00

(Migrated from github.com)

Hi @jonschlinkert are there any plans to fix this dangerous default mode in a future release? (There was this recent issue in a popular project, caused by this unexpected behavior: github.com/simonhaenisch/md-to-pdf@46bdcf2051)

Hi @jonschlinkert are there any plans to fix this dangerous default mode in a future release? (There was this recent issue in a popular project, caused by this unexpected behavior: https://github.com/simonhaenisch/md-to-pdf/commit/46bdcf2051c8d1758b391c1353185a179a47a4d9)

mrleblanc101 commented

2026-08-20 20:56:09 +00:00

(Migrated from github.com)

I get this warning when building my app now.

node: 22.21.0 pnpm: 8.15.5

I get this warning when building my app now. node: 22.21.0 pnpm: 8.15.5 <img width="1246" height="173" alt="Image" src="https://github.com/user-attachments/assets/2a01c869-395c-4d8c-8ea7-74c85af56001" />

Rows
Columns

Security consideration: disable JS engine by default to prevent RCEs in dependents #131