CVE-2026-78847: gray-matter RCE Vulnerability

CVE-2026-78847 Overview

CVE-2026-78847 is an arbitrary code execution vulnerability in the gray-matter npm package, verified against version 4.0.3 and affecting all versions. The flaw resides in lib/engines.js, where the JavaScript engine uses eval() to parse front matter when the language is declared as js or javascript. Any application that feeds untrusted Markdown or YAML front matter through gray-matter can trigger execution of attacker-controlled JavaScript in the Node.js process. The issue is classified as [CWE-95] Improper Neutralization of Directives in Dynamically Evaluated Code (Eval Injection).

Critical Impact
Attackers can achieve arbitrary code execution on any Node.js host that parses attacker-controlled front matter through gray-matter, leading to full application compromise.

Affected Products

gray-matter npm package, all versions (verified on 4.0.3)
Node.js applications that call gray-matter on untrusted input
Static site generators, CMS pipelines, and Markdown processors that depend on gray-matter

Discovery Timeline

2026-09-21 - CVE-2026-78847 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-78847

Vulnerability Analysis

The gray-matter library parses front matter blocks at the top of Markdown files. Front matter is typically declared in YAML, TOML, or JSON, but gray-matter also ships a JavaScript engine that executes the block as code. When the front matter fence declares the language as js or javascript, the library routes the content to lib/engines.js and evaluates it using eval(). Any expression or statement placed inside the front matter runs with the privileges of the Node.js process. Applications that accept Markdown from users, upstream repositories, or third-party content feeds inherit this exposure directly. Because the vulnerable path is reachable through the default matter() entry point, developers often invoke it without realizing the JavaScript engine is available.

Root Cause

The root cause is the use of eval() on unsanitized input in the JavaScript language engine defined in lib/engines.js. eval() executes any syntactically valid JavaScript in the current scope, so there is no boundary between parsed data and executable code. Community discussion in GitHub Issue #112, Issue #131, and Issue #182 tracks the behavior across releases.

Attack Vector

An attacker crafts a Markdown or content file that begins with a JavaScript-language front matter fence containing an arbitrary payload. When the host application parses the file with gray-matter, the payload executes in the Node.js runtime. Delivery paths include pull requests to documentation repositories, user-supplied CMS posts, Markdown ingested by build pipelines, and third-party content synced into static site generators. Additional technical detail is available in the Checo Blog security post.

No verified public proof-of-concept code is included with this advisory. The referenced blog post and GitHub issues describe the front-matter language declaration and eval() execution path in detail.

Detection Methods for CVE-2026-78847

Indicators of Compromise

Markdown or content files whose front matter fence declares js or javascript as the language
Unexpected child processes spawned by Node.js build tools such as static site generators or CMS workers
Outbound network connections initiated from build or content-processing hosts to unfamiliar destinations
File writes or credential access originating from processes that only should parse Markdown

Detection Strategies

Perform dependency scanning across package.json and lockfiles to enumerate every direct and transitive use of gray-matter
Grep content repositories for front matter fences that declare js or javascript languages
Instrument Node.js runtimes to alert when eval is called from within gray-matter/lib/engines.js
Baseline expected process trees for build agents and alert on deviations such as shell or interpreter spawns

Monitoring Recommendations

Monitor CI/CD build logs for anomalous execution during Markdown parsing steps
Forward endpoint telemetry from build servers and content workers into a centralized data lake for correlation
Track outbound egress from Node.js content-processing hosts and alert on connections to non-allowlisted domains
Audit newly merged content commits that introduce JavaScript-language front matter

How to Mitigate CVE-2026-78847

Immediate Actions Required

Inventory every application and pipeline that depends on gray-matter, including transitive dependencies
Disable the JavaScript engine when invoking matter() by supplying an engines option that omits javascript
Reject or quarantine any content file whose front matter declares js or javascript as the language
Restrict build and content-processing workloads to least-privilege service accounts with no access to production secrets

Patch Information

No fixed upstream version is identified in the CVE record; the advisory states the issue is verified on gray-matter4.0.3 and affects all versions. Track the gray-matter GitHub issues for maintainer guidance and consider replacing the dependency with a parser that does not execute front matter, such as a YAML-only alternative.

Workarounds

Override the engines option passed to gray-matter so that requests for js or javascript map to a safe no-op parser
Pre-validate incoming Markdown and strip or reject any front matter block that specifies a JavaScript language
Run Markdown parsing in an isolated sandbox such as a container or vm2-style boundary with no network or filesystem access
Enforce code review policies that block pull requests introducing JavaScript-language front matter

bash

# Configuration example: disable the JavaScript engine when calling gray-matter
node -e "const matter = require('gray-matter');\
const result = matter(input, { engines: { javascript: () => { throw new Error('js front matter disabled'); }, js: () => { throw new Error('js front matter disabled'); } } });"