Remove RCE-vulnerable JavaScript engine (CWE-94) #182

Open

MorielHarush wants to merge 1 commit from MorielHarush/master into master

MorielHarush commented

2026-03-10 13:33:38 +00:00

(Migrated from github.com)

Description: This PR removes the javascript engine from lib/engines.js. The current implementation uses eval(), allowing for Remote Code Execution (RCE) by default.

The Vulnerability: gray-matter automatically identifies the engine from the delimiter (e.g., ---javascript). Since the javascript engine is registered in the core library, an attacker can execute arbitrary system commands simply by providing a malicious string to the matter() function—even with zero configuration from the developer.

Proof of Concept (PoC):

JavaScript
const matter = require('gray-matter');
const malicious = `---javascript
require('child_process').execSync('id').toString()
---
Hello world`;
const result = matter(malicious); 
console.log('[RCE] Command output:', result.data);

Impact: Any application using gray-matter to parse user-supplied content is vulnerable to full system compromise. This is a critical security flaw (CWE-94: Improper Control of Generation of Code).

Proposed Changes:

Removed the javascript engine from lib/engines.js.
Users who require dynamic front-matter should now be required to implement their own (secure) parser and pass it explicitly in the options.

**Description:** This PR removes the javascript engine from lib/engines.js. The current implementation uses eval(), allowing for Remote Code Execution (RCE) by default. **The Vulnerability:** gray-matter automatically identifies the engine from the delimiter (e.g., ---javascript). Since the javascript engine is registered in the core library, an attacker can execute arbitrary system commands simply by providing a malicious string to the matter() function—even with zero configuration from the developer. **Proof of Concept (PoC):** ``` JavaScript const matter = require('gray-matter'); const malicious = `---javascript require('child_process').execSync('id').toString() --- Hello world`; const result = matter(malicious); console.log('[RCE] Command output:', result.data); ``` <img width="1253" height="271" alt="image" src="https://github.com/user-attachments/assets/a9f88159-6862-40b9-aa5f-fa2c7e7b9b31" /> **Impact:** Any application using gray-matter to parse user-supplied content is vulnerable to full system compromise. This is a critical security flaw (CWE-94: Improper Control of Generation of Code). **Proposed Changes:** * Removed the javascript engine from lib/engines.js. * Users who require dynamic front-matter should now be required to implement their own (secure) parser and pass it explicitly in the options.

slorber commented

2026-06-19 13:14:56 +00:00

(Migrated from github.com)

FYI, there's a maintained fork here: https://github.com/11ty/gray-matter

Already adopted by Eleventy and Docusaurus (see https://github.com/facebook/docusaurus/pull/12181)

v2 removed the js engine by default, see also https://github.com/facebook/docusaurus/pull/12181#issuecomment-4745415698

FYI, there's a maintained fork here: https://github.com/11ty/gray-matter Already adopted by Eleventy and Docusaurus (see https://github.com/facebook/docusaurus/pull/12181) v2 removed the js engine by default, see also https://github.com/facebook/docusaurus/pull/12181#issuecomment-4745415698

MorielHarush commented

2026-06-22 06:38:54 +00:00

(Migrated from github.com)

FYI, there's a maintained fork here: https://github.com/11ty/gray-matter

Already adopted by Eleventy and Docusaurus (see facebook/docusaurus#12181)

v2 removed the js engine by default, see also facebook/docusaurus#12181 (comment)

Thanks for the update, @slorber!

I'm glad to see that the community took this RCE vulnerability seriously and acted so quickly to mitigate it. It's awesome that Eleventy and Docusaurus are already adopting the secure v2 fork to protect millions of users.

Thanks again for keeping me in the loop and for driving the adoption of the secure version across major projects! 🚀

> FYI, there's a maintained fork here: https://github.com/11ty/gray-matter > > Already adopted by Eleventy and Docusaurus (see [facebook/docusaurus#12181](https://github.com/facebook/docusaurus/pull/12181)) > > v2 removed the js engine by default, see also [facebook/docusaurus#12181 (comment)](https://github.com/facebook/docusaurus/pull/12181#issuecomment-4745415698) Thanks for the update, @slorber! I'm glad to see that the community took this RCE vulnerability seriously and acted so quickly to mitigate it. It's awesome that Eleventy and Docusaurus are already adopting the secure v2 fork to protect millions of users. Thanks again for keeping me in the loop and for driving the adoption of the secure version across major projects! 🚀

👍 1

This pull request has changes conflicting with the target branch.

lib/engines.js

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title

Merge pull request 'Remove RCE-vulnerable JavaScript engine (CWE-94)' (#182) from MorielHarush/master into master

Merge commit body

Reviewed-on: https://repo.reapertech.com/rtlabs-llm-agents/gms-gray-matter/pulls/182

Merge pull request 'Remove RCE-vulnerable JavaScript engine (CWE-94)' (#182) from MorielHarush/master into master

Reviewed-on: https://repo.reapertech.com/rtlabs-llm-agents/gms-gray-matter/pulls/182