CVE-2026-78847

critical · 9.8

An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code execution.

9.8

CVSS

0.5%

EPSS (exploit prob.)

40th

EPSS percentile

2026-09-21

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-95

References

https://blog.checo.cc/en/posts/Security/1
https://github.com/jonschlinkert/gray-matter/issues/112
https://github.com/jonschlinkert/gray-matter/issues/131
https://github.com/jonschlinkert/gray-matter/issues/182
https://github.com/jonschlinkert/gray-matter/issues/182

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-78847