A critical remote code execution vulnerability in the gray-matter library allows unauthenticated attackers to execute arbitrary code via malicious front matter input.

This vulnerability stems from the use of the eval() function within lib/engines.js to parse front matter when the language is set to js or javascript. Because the input is processed without sanitization, an unauthenticated attacker can supply crafted content to trigger arbitrary code execution on the host system.

The ability to execute arbitrary code allows an attacker to take full control of the affected application, potentially leading to unauthorized data exfiltration, system compromise, or complete service disruption. Given the CVSS score of 9.8, this vulnerability represents a critical risk to organizational confidentiality, integrity, and availability.

Immediate Action: Since no official patch is currently available, users should restrict the use of gray-matter to trusted inputs only or migrate to a safer alternative that does not utilize eval() for parsing front matter.

Proactive Monitoring: Security teams should monitor application logs for anomalous process execution or unexpected file access patterns originating from the server running the gray-matter library.

Compensating Controls: Implement strict input validation or sandboxing mechanisms to isolate the parsing engine, and ensure the application runs with the least privilege necessary to limit the impact of potential code execution.

Public Exploit Available: Unknown.

Due to the critical nature of this vulnerability and the lack of an immediate vendor patch, organizations must treat this issue with high urgency. It is recommended to audit all deployments of gray-matter to identify where it processes external or untrusted data and implement strict input controls until a secure update is released by the maintainers.