CVE-2026-78847

Deferred Deferred - Pending Action

Arbitrary Code Execution in gray-matter via JavaScript Engine

Publication date: 2026-09-21

Last updated on: 2026-09-22

Assigner: MITRE

Description

An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-22

Generated

2026-10-12

AI Q&A

2026-09-22

EPSS Evaluated

2026-10-10

NVD

CVE-2026-78847

EUVD

EUVD-2026-84241

Affected Vendors & Products

Vendor	Product	Version / Range
gray-matter	gray-matter	to 4.0.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-95	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

Executive Summary

This vulnerability in gray-matter versions up to 4.0.3 allows arbitrary code execution due to the use of eval() in lib/engines.js when parsing front matter with a language set to js or javascript.

Detection Guidance

This vulnerability involves arbitrary code execution via eval() in gray-matter when parsing front matter with js/javascript language. To detect it, inspect applications using gray-matter for front matter parsing with JavaScript engine. Check for unexpected or suspicious code execution in logs or system behavior. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to execute malicious JavaScript code on your system if you process untrusted input with gray-matter, potentially leading to data theft, system compromise, or further attacks.

Compliance Impact

This vulnerability could lead to unauthorized data access or processing, violating GDPR's data protection principles or HIPAA's security requirements for protected health information.

Mitigation Strategies

Immediately stop using gray-matter library versions affected by this issue. Update to the latest patched version if available. Review any applications using gray-matter to ensure they do not parse untrusted input with JavaScript front matter.

Hi! I’m here to help you understand CVE-2026-78847. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70