The vulnerability originates in the gray‑matter library, where the JavaScript engine in lib/engines.js calls eval() on front matter marked with the language js or javascript. An attacker can embed arbitrary JavaScript code into the front matter block, and when the file is parsed that code is executed with the same privileges as the application. This flaw permits full compromise of confidentiality, integrity and availability by allowing arbitrary code execution.

The gray‑matter npm package, maintained by Jonas Schlinkert, is widely used in static site generators and markdown processors. All released versions of the package, including 4.0.3, are affected. Any system that imports or processes content with gray‑matter without prior validation is at risk.

The CVSS score of 9.8 marks this vulnerability as critical. The EPSS score of <1% indicates a low but non‑zero probability of exploitation. The vulnerability does not require authentication; the attacker can simply provide a crafted file. It is inferred that uploading or ingesting a file containing malicious front matter would trigger the flaw. The vulnerability is not listed in the CISA KEV catalog.