External risk intelligence

JavaScript Engine in gray-matter Allows Arbitrary Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-78847

This vulnerability exists in a JavaScript library (gray-matter) used for parsing front matter in files. It is a build-time or developer-side dependency typically used within static site generators or local development environments, not a network-facing service, appliance, or edge gateway.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a component used in development and build processes that could allow for arbitrary code execution. The primary concern is to confirm if this component is used within our environment and, if so, to assess the potential exposure.

Code execution risk in development tools.
Understand its use in our software supply chain.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a system into processing specially crafted JavaScript code within front matter. This could occur if the system uses the gray-matter library to parse file content, allowing the attacker to execute arbitrary code on the affected system.

No special access needed.
Malicious JavaScript in front matter.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, the JavaScript engine in gray-matter could execute arbitrary code if it parses front matter with a JavaScript language. This could affect system data and service behavior when processing such files.

System data and service behavior.
Arbitrary code execution when parsing JavaScript.
Potential compromise of the host system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the gray-matter library's JavaScript engine can lead to arbitrary code execution if front matter is parsed with a JavaScript language specifier. Responsibility likely falls to application owners and development teams who integrate this library into their build processes or local development environments. The immediate priority is to inventory all systems and codebases using gray-matter, confirm exposure within your environment, and then plan remediation, potentially involving code updates or configuration changes by development teams.

Application owners should manage this issue.
Verify gray-matter usage in codebases.
Plan code updates or configuration changes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is gray-matter and how is it used?

gray-matter is a library used in JavaScript development to parse "front matter," which is metadata typically placed at the top of files like Markdown. Developers rely on it to extract information such as titles, dates, or tags from files during build processes, static site generation, or local content management tasks.

What does CVE-2026-78847 mean for my software?

This vulnerability is classified as Improper Neutralization of Directives in Dynamically Evaluated Code (CWE-95). It happens because the library uses the eval() function to process front matter when JavaScript is specified as the language. This creates a weakness where the engine might treat malicious input as executable commands instead of simple data.

How does an attacker trigger this vulnerability?

An attacker must provide a file containing specially crafted JavaScript code within the front matter section. The system becomes vulnerable only when it processes this specific file using the gray-matter library with JavaScript parsing enabled. If your implementation does not use the JavaScript parsing feature for front matter, this specific bug is not triggered.

Do I need to worry about this if my app is internal?

Halo Surface Signal notes this library is typically a build-time dependency rather than a network-facing service. While internal tools are less reachable from the internet, you should still care if these tools process untrusted files. Any system that parses external content using this library carries risk, regardless of whether the system itself is public-facing.

When should I take action on CVE-2026-78847?

You should act by first auditing your codebase to locate where gray-matter is integrated. Prioritize environments where the library handles input from users or external sources. Work with your development teams to determine if you are using the vulnerable JavaScript parsing feature and plan to migrate to a safer configuration or update to a non-vulnerable version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.