{"record":{"id":"f2181a93483d0373","repo":"gatsbyjs/gatsby","slug":"js-frontmatter-engine-is-enabled-in-gatsby-transfo","errorCode":null,"errorMessage":"JS frontmatter engine is enabled in gatsby-transformer-remark (via jsFrontmatterEngine: true). This can cause a security risk, see https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcw. If you are not relying on this feature we strongly suggest disabling it via the \"jsFrontmatterEngine: false\" plugin option. If you rely on this feature make sure to properly secure or sanitize your content source.","messagePattern":"JS frontmatter engine is enabled in gatsby-transformer-remark \\(via jsFrontmatterEngine: true\\)\\. This can cause a security risk, see https://github\\.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcw\\. If you are not relying on this feature we strongly suggest disabling it via the \"jsFrontmatterEngine: false\" plugin option\\. If you rely on this feature make sure to properly secure or sanitize your content source\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/gatsby-transformer-remark/src/gatsby-node.js","lineNumber":36,"sourceCode":"    excerpt_separator: Joi.string().description(\n      `If your Markdown file contains HTML, excerpt will not return a value. In that case, you can set an excerpt_separator to an HTML tag. Edit your Markdown files to include that HTML tag after the text you’d like to appear in the excerpt.`\n    ),\n    plugins: Joi.subPlugins().description(\n      `A list of remark plugins. See also: https://github.com/gatsbyjs/gatsby/tree/master/examples/using-remark for examples`\n    ),\n    // TODO(v6): Remove and disallow any custom engines (including JS)\n    jsFrontmatterEngine: Joi.boolean()\n      .default(false)\n      .description(\n        `Enable JS for https://github.com/jonschlinkert/gray-matter#optionsengines`\n      ),\n  }).custom(value => {\n    const { jsFrontmatterEngine, engines = {} } = value || {}\n\n    if (jsFrontmatterEngine) {\n      // show this warning only once in main process\n      if (!process.env.GATSBY_WORKER_ID) {\n        console.warn(\n          `JS frontmatter engine is enabled in gatsby-transformer-remark (via jsFrontmatterEngine: true). This can cause a security risk, see https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcw. If you are not relying on this feature we strongly suggest disabling it via the \"jsFrontmatterEngine: false\" plugin option. If you rely on this feature make sure to properly secure or sanitize your content source.`\n        )\n      }\n      return value\n    }\n\n    const js = () => {\n      if (!warnedAboutJSFrontmatterEngine) {\n        console.warn(\n          `You have frontmatter declared with \"---js\" or \"---javascript\" that is not parsed by default to mitigate a security risk (see https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcw). If you require this feature it can be enabled by setting \"jsFrontmatterEngine: true\" in the plugin options of gatsby-transformer-remark.`\n        )\n        warnedAboutJSFrontmatterEngine = true\n      }\n      // we still have to return a frontmatter, so we just stub it with empty object\n      return {}\n    }\n\n    return {","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/gatsbyjs/gatsby/blob/e85d62f1779e353eaac1753211629a26d123e26c/packages/gatsby-transformer-remark/src/gatsby-node.js#L18-L54","documentation":"Error \"JS frontmatter engine is enabled in gatsby-transformer-remark (via jsFrontmatterEngine: true). This can cause a security risk, see https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcw. If you are not relying on this feature we strongly suggest disabling it via the \"jsFrontmatterEngine: false\" plugin option. If you rely on this feature make sure to properly secure or sanitize your content source.\" thrown in gatsbyjs/gatsby.","triggerScenarios":"Thrown at packages/gatsby-transformer-remark/src/gatsby-node.js:36 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["If you don't use `---js` frontmatter, set jsFrontmatterEngine: false in gatsby-transformer-remark options to silence the warning and close the security risk","If you do use it, sanitize or fully control the markdown source (untrusted content allows arbitrary JS execution, see GHSA-7ch4-rr99-cqcw)","Migrate JS frontmatter to data-only frontmatter or a separate JSON/YAML source"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e85d62f1779e353eaac1753211629a26d123e26c","analyzedAt":"2026-08-26T17:50:09.662Z","contentChangedAt":"2026-08-26T17:50:09.662Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}