CVE-2025-65108: Gray Matter Javascript Engine Not Disabled
gray-matter is called without explicitly disabling the 'javascript' evaluation engine. Front-matter blocks using '---javascript' (or '---js') delimiters execute their body as arbitrary Node.js code, enabling remote code execution (CVE-2025-65108). Disabling only the 'js' alias key is insufficient; the canonical key is 'javascript'. Fix: matter(input, { engin
JSgreprules fetch cve-2025-65108-gray-matter-javascript-engine-not-disabled --engine opengrepDescription
gray-matter is called without explicitly disabling the 'javascript' evaluation engine. Front-matter blocks using '---javascript' (or '---js') delimiters execute their body as arbitrary Node.js code, enabling remote code execution (CVE-2025-65108). Disabling only the 'js' alias key is insufficient; the canonical key is 'javascript'. Fix: matter(input, { engin
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.