Gatsby Plugin MDX Deserialization Vulnerability Allowing JavaScript Execution

A vulnerability allowing deserialization of untrusted data has been identified in the Gatsby plugin MDX, specifically in versions prior to 2.14.1, from 3.0.0, and prior to 3.15.2. This vulnerability arises from the plugin's default configuration, which lacks proper input sanitization, allowing maliciously crafted frontmatter to be executed as JavaScript. The issue can be exploited in both webpack and data modes, such as when MDX files are processed as components in React or queried via GraphQL. A proof-of-concept demonstrating the vulnerability is available.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the server where the Gatsby application is running.

Reproduction

The vulnerability can be reproduced by creating an MDX file with JavaScript frontmatter that includes a payload, such as a command to create a file. When this MDX file is processed by Gatsby, the JavaScript frontmatter is executed, allowing the payload to be executed as well. This can be done by importing the MDX file as a component in a React page or by querying it through GraphQL.

Remediation

Users should upgrade to Gatsby plugin MDX versions 2.14.1, 3.15.2 or higher. If an upgrade is not possible, input passed to the plugin should be sanitized before processing.