An issue in gray-matter causes the JavaScript engine in lib/engines.js to invoke eval() on front matter when the declared language is js or javascript. This flaw allows an attacker to embed malicious code into front matter that will be executed in the context of the JavaScript engine, leading to arbitrary code execution. The vulnerability can compromise confidentiality, integrity, and availability of any system that processes user-supplied gray-matter files.

The npm package gray-matter (v4.0.3 and earlier) is affected. All versions verified to be vulnerable until a remediation is applied. The package is maintained by Jonas Schlinkert and is widely used in static site generators, markdown processors, and other JavaScript environments.

The exploit requires the attacker to supply a file or content that includes front matter marked with language js/javascript. Once parsed, the eval() call will execute the malicious code. This is a high-severity flaw because it achieves arbitrary code execution without further authentication. Although EPSS data is unavailable, the CVE is not listed in CISA KEV, but the severity of the impact suggests a high likelihood of exploitation in exposed environments. The likely attack vector is injection of malicious front matter via uploaded files or crafted content in a web application that consumes gray-matter.