Most recent entries from all

EUVD-2026-209249

fkie_cve-2023-34238

Gatsby is a free and open source framework based on React. The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the `__file-code-frame` and `__original-stack-frame` paths, exposed when running the Gatsby develop server (`gatsby develop`). Any file in scope of the development server could potentially be exposed. It should be noted that by default `gatsby develop` is only accessible via the localhost `127.0.0.1`, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as `--host 0.0.0.0`, `-H 0.0.0.0`, or the `GATSBY_HOST=0.0.0.0` environment variable. A patch has been introduced in `gatsby@5.9.1` and `gatsby@4.25.7` which mitigates the issue. Users are advised to upgrade. Users unable to upgrade should avoid exposing their development server to the internet.

GHSA-c6f8-8r25-c4gc — Gatsby develop server has Local File Inclusion vulnerability

Affected: npm: gatsby

### Impact

The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the `__file-code-frame` and `__original-stack-frame` paths, exposed when running the Gatsby develop server (`gatsby develop`).

The following steps can be used to reproduce the vulnerability:

``` # Create a new Gatsby project $ npm init gatsby $ cd my-gatsby-site

# Start the Gatsby develop server $ gatsby develop

# Execute the Local File Inclusion vulnerability in __file-code-frame $ curl "http://127.0.0.1:8000/__file-code-frame?filePath=/etc/passwd&lineNumber=1"

# Execute the Local File Inclusion vulnerability in __original-stack-frame $ curl "http://127.0.0.1:8000/__original-stack-frame?moduleId=/etc/hosts&lineNumber=1&skipSourceMap=1" ```

It should be noted that by default `gatsby develop` is only accessible via the localhost `127.0.0.1`, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as `--host 0.0.0.0`, `-H 0.0.0.0`, or the `GATSBY_HOST=0.0.0.0` environment variable.

### Patches

A patch has been introduced in `gatsby@5.9.1` and `gatsby@4.25.7` which mitigates the issue.

### Workarounds

As stated above, by default `gatsby develop` is only exposed to the localhost `127.0.0.1`. For those using the develop server in the default configuration no risk is posed. If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or…

Most recent entries from all

EUVD-2026-209249

fkie_cve-2023-34238

GHSA-c6f8-8r25-c4gc — Gatsby develop server has Local File Inclusion vulnerability

gsd-2023-34238