Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency gatsby-transformer-remark to v5 [security] #1226

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): update dependency gatsby-transformer-remark to v5 [security] #1226

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Mar 17, 2023 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
gatsby-transformer-remark (source) 4.11.0 -> 5.25.1 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-22491

Impact

The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present in gatsby-transformer-remark when passing input in data mode (querying MarkdownRemark nodes via GraphQL). Injected JavaScript executes in the context of the build server.

To exploit this vulnerability untrusted/unsanitized input would need to be sourced by or added into a file processed by gatsby-transformer-remark. The following payload demonstrates a vulnerable configuration:

---js
((require("child_process")).execSync("id >> /tmp/rce"))
---

Patches

A patch has been introduced in [email protected] and [email protected] which mitigates the issue by disabling the gray-matter JavaScript Frontmatter engine. The patch introduces a new option, JSFrontmatterEngine which is set to false by default. When setting JSFrontmatterEngine to true, input passed to gatsby-plugin-mdx must be sanitized before processing to avoid a security risk. Warnings are displayed when enabling JSFrontmatterEngine to true or if it appears that the MarkdownRemark input is attempting to use the Frontmatter engine.

Workarounds

If an older version of gatsby-transformer-remark must be used, input passed into the plugin should be sanitized ahead of processing.

We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.

For more information

Email us at [email protected].

Release Notes

gatsbyjs/gatsby (gatsby-transformer-remark)

v5.25.1

Compare Source

v5.25.0

Compare Source

v5.24.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

5.23.1 (2022-09-22)

Note: Version bump only for package gatsby-transformer-remark

v5.23.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.23.0

Compare Source

🧾 Release notes

Chores

v5.22.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.21.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.20.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.19.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

5.18.1 (2022-07-12)

Note: Version bump only for package gatsby-transformer-remark

v5.18.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.18.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.17.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.16.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

5.15.1 (2022-06-01)

Note: Version bump only for package gatsby-transformer-remark

v5.15.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.15.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.14.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.13.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

5.12.1 (2022-04-13)

Note: Version bump only for package gatsby-transformer-remark

v5.12.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.12.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

5.11.1 (2022-03-31)

Note: Version bump only for package gatsby-transformer-remark

v5.11.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.11.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

5.10.2 (2022-03-23)

Note: Version bump only for package gatsby-transformer-remark

5.10.1 (2022-03-18)

Note: Version bump only for package gatsby-transformer-remark

v5.10.2

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.10.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.10.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

5.9.1 (2022-03-09)

Note: Version bump only for package gatsby-transformer-remark

v5.9.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.9.0

Compare Source

🧾 Release notes

Chores
5.8.2 (2022-03-01)

Note: Version bump only for package gatsby-transformer-remark

5.8.1 (2022-02-25)

Note: Version bump only for package gatsby-transformer-remark

v5.8.2

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.8.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.8.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.7.0

Compare Source

🧾 Release notes

Bug Fixes
  • update dependency underscore.string to ^3.3.6 for gatsby-transformer-remark #​34653 (1d2530e)

v5.6.0

Compare Source

🧾 Release notes

Bug Fixes
5.5.2 (2022-01-17)

Note: Version bump only for package gatsby-transformer-remark

5.5.1 (2022-01-12)

Note: Version bump only for package gatsby-transformer-remark

v5.5.2

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.5.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.5.0

Compare Source

🧾 Release notes

Chores

v5.4.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.3.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.2.0

Compare Source

🧾 Release notes

Bug Fixes
5.1.4 (2021-11-15)

Note: Version bump only for package gatsby-transformer-remark

5.1.3 (2021-11-11)

Note: Version bump only for package gatsby-transformer-remark

5.1.2 (2021-11-10)

Note: Version bump only for package gatsby-transformer-remark

5.1.1 (2021-11-09)
Bug Fixes

v5.1.4

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.1.3

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.1.2

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.1.1

Compare Source

Bug Fixes

v5.1.0

Compare Source

🧾 Release notes

Bug Fixes
  • update minor and patch dependencies for gatsby-transformer-remark #​32613 (a1b315f)

v5.0.0

Compare Source

🧾 Release notes

Features
Chores
Other Changes

v4.12.0

Compare Source

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch 7 times, most recently from fd4c398 to b6b777b Compare March 21, 2023 11:40
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch 2 times, most recently from ec8496f to 4525828 Compare March 24, 2023 11:14
@renovate renovate bot changed the title chore(deps): update dependency gatsby-transformer-remark to v5 [security] chore(deps): update dependency gatsby-transformer-remark to v5 [security] - autoclosed Mar 30, 2023
@renovate renovate bot closed this Mar 30, 2023
@renovate renovate bot deleted the renovate/npm-gatsby-transformer-remark-vulnerability branch March 30, 2023 02:20
@renovate renovate bot changed the title chore(deps): update dependency gatsby-transformer-remark to v5 [security] - autoclosed chore(deps): update dependency gatsby-transformer-remark to v5 [security] Mar 30, 2023
@renovate renovate bot reopened this Mar 30, 2023
@renovate renovate bot restored the renovate/npm-gatsby-transformer-remark-vulnerability branch March 30, 2023 03:18
@renovate renovate bot changed the title chore(deps): update dependency gatsby-transformer-remark to v5 [security] chore(deps): update dependency gatsby-transformer-remark to v5 [security] - autoclosed May 10, 2023
@renovate renovate bot closed this May 10, 2023
@renovate renovate bot deleted the renovate/npm-gatsby-transformer-remark-vulnerability branch May 10, 2023 02:33
@renovate renovate bot changed the title chore(deps): update dependency gatsby-transformer-remark to v5 [security] - autoclosed chore(deps): update dependency gatsby-transformer-remark to v5 [security] May 10, 2023
@renovate renovate bot reopened this May 10, 2023
@renovate renovate bot restored the renovate/npm-gatsby-transformer-remark-vulnerability branch May 10, 2023 06:00
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 4525828 to 56ac711 Compare May 10, 2023 06:01
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch 4 times, most recently from 1883491 to 68cc15d Compare June 13, 2023 14:54
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 68cc15d to 099a98a Compare June 23, 2023 21:16
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 099a98a to 6833dd4 Compare July 8, 2023 21:43
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 6833dd4 to 2b8eb23 Compare August 9, 2023 18:04
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 2b8eb23 to ff43bda Compare August 18, 2023 22:41
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from ff43bda to 6ecd28d Compare September 4, 2023 17:37
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 6ecd28d to 8d0ad08 Compare October 23, 2023 19:20
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 8d0ad08 to aa7ec33 Compare January 17, 2024 21:24
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from aa7ec33 to fe847e8 Compare March 10, 2024 07:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants