Listen to this Post
The vulnerability arises because tinacms utilizes the gray-matter npm package to parse front matter in markdown files without overriding its default dangerous configuration. Gray-matter is designed to support various front matter formats, including JavaScript, and by default, it will evaluate JS code found within `js` delimiters. Tinacms does not pass a safe options object to gray-matter to disable this engine, meaning when it processes markdown content—such as blog posts uploaded by users—any JavaScript within the front matter is executed server-side. An attacker who can inject or modify a markdown file, perhaps through a content upload feature or compromised supply chain, can place arbitrary code within `js` blocks. This code runs with the privileges of the Node.js process, allowing require() calls to access the filesystem, execute commands, and potentially lead to full remote code execution. The core issue is the violation of the data-only expectation for markdown, turning content parsing into a code execution mechanism.
Platform: tinacms
Version: All affected
Vulnerability: Arbitrary Code Execution
Severity: Critical
date: Unknown
Prediction: No patch scheduled
What Undercode Say:
npx create-tina-app@latest npm run dev
js
{
"": "Pawned" + console.log(require("fs").readFileSync("/etc/passwd").toString())
}
How Exploit:
Create malicious markdown file with JS front matter. Process it with tinacms.
Protection from this CVE
Disable gray-matter js engine. Use safe parsing options.
Impact:
Full server compromise. Remote Code Execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
