{"id":"CVE-2026-78847","published":"2026-09-21T22:16:58.863","lastModified":"2026-09-21T22:16:58.863","description":"An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code execution.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://blog.checo.cc/en/posts/Security/1","tags":[]},{"url":"https://github.com/jonschlinkert/gray-matter/issues/112","tags":[]},{"url":"https://github.com/jonschlinkert/gray-matter/issues/131","tags":[]},{"url":"https://github.com/jonschlinkert/gray-matter/issues/182","tags":[]}],"exploitRefs":[{"url":"https://github.com/jonschlinkert/gray-matter/issues/112","tags":[]},{"url":"https://github.com/jonschlinkert/gray-matter/issues/131","tags":[]},{"url":"https://github.com/jonschlinkert/gray-matter/issues/182","tags":[]}],"hasPoc":true,"ai":null}