Bug 2537934 (CVE-2026-78847) - CVE-2026-78847 gray-matter: gray-matter: arbitrary code execution via eval in front matter parsing
Summary: CVE-2026-78847 gray-matter: gray-matter: arbitrary code execution via eval in...
Keywords:
Status: NEW
Alias: CVE-2026-78847
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2546717 2546719 2546720 2546721 2546722 2546723 2546718 2546724
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-22 16:08 UTC by OSIDB Bzimport
Modified: 2026-10-06 17:54 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-22 16:08:30 UTC 
An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code execution.
Note You need to log in before you can comment on or make changes to this bug.