CVE-2022-25863 - CVE House

Back to Database

Status published High CVE-2022-25863

Deserialization of Untrusted Data

8.1 CVSS

Vulnerability Description

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL). Workaround: If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-25863

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Feng Xiao and Zhongfu Su

References

More from n/a

View All →

Versions of the package jsondiffpatch before 0.7.2 are vulnerable to...

RemoteClinic profile.php sql injection

Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery

RemoteClinic edit-my-profile.php unrestricted upload

RemoteClinic edit-patient.php information disclosure

Affected Vendor

n/a

View all reports →

Affected Software

gatsby-plugin-mdx

Vulnerable Versions:

unspecified, 3.0.0

Timeline

Official Publish: June 10th, 2022

Last Modified: September 17th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.