gatsbyjs/gatsby · error

JS frontmatter engine is enabled in gatsby-transformer-remar

Error message

JS frontmatter engine is enabled in gatsby-transformer-remark (via jsFrontmatterEngine: true). This can cause a security risk, see https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcw. If you are not relying on this feature we strongly suggest disabling it via the "jsFrontmatterEngine: false" plugin option. If you rely on this feature make sure to properly secure or sanitize your content source.

What it means

Error "JS frontmatter engine is enabled in gatsby-transformer-remark (via jsFrontmatterEngine: true). This can cause a security risk, see https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcw. If you are not relying on this feature we strongly suggest disabling it via the "jsFrontmatterEngine: false" plugin option. If you rely on this feature make sure to properly secure or sanitize your content source." thrown in gatsbyjs/gatsby.

Source

Thrown at packages/gatsby-transformer-remark/src/gatsby-node.js:36

    excerpt_separator: Joi.string().description(
      `If your Markdown file contains HTML, excerpt will not return a value. In that case, you can set an excerpt_separator to an HTML tag. Edit your Markdown files to include that HTML tag after the text you’d like to appear in the excerpt.`
    ),
    plugins: Joi.subPlugins().description(
      `A list of remark plugins. See also: https://github.com/gatsbyjs/gatsby/tree/master/examples/using-remark for examples`
    ),
    // TODO(v6): Remove and disallow any custom engines (including JS)
    jsFrontmatterEngine: Joi.boolean()
      .default(false)
      .description(
        `Enable JS for https://github.com/jonschlinkert/gray-matter#optionsengines`
      ),
  }).custom(value => {
    const { jsFrontmatterEngine, engines = {} } = value || {}

    if (jsFrontmatterEngine) {
      // show this warning only once in main process
      if (!process.env.GATSBY_WORKER_ID) {
        console.warn(
          `JS frontmatter engine is enabled in gatsby-transformer-remark (via jsFrontmatterEngine: true). This can cause a security risk, see https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcw. If you are not relying on this feature we strongly suggest disabling it via the "jsFrontmatterEngine: false" plugin option. If you rely on this feature make sure to properly secure or sanitize your content source.`
        )
      }
      return value
    }

    const js = () => {
      if (!warnedAboutJSFrontmatterEngine) {
        console.warn(
          `You have frontmatter declared with "---js" or "---javascript" that is not parsed by default to mitigate a security risk (see https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcw). If you require this feature it can be enabled by setting "jsFrontmatterEngine: true" in the plugin options of gatsby-transformer-remark.`
        )
        warnedAboutJSFrontmatterEngine = true
      }
      // we still have to return a frontmatter, so we just stub it with empty object
      return {}
    }

    return {

View on GitHub (pinned to e85d62f177)

Solutions

1. If you don't use `---js` frontmatter, set jsFrontmatterEngine: false in gatsby-transformer-remark options to silence the warning and close the security risk
2. If you do use it, sanitize or fully control the markdown source (untrusted content allows arbitrary JS execution, see GHSA-7ch4-rr99-cqcw)
3. Migrate JS frontmatter to data-only frontmatter or a separate JSON/YAML source

When it happens

Trigger: Thrown at packages/gatsby-transformer-remark/src/gatsby-node.js:36 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gatsbyjs/gatsby@e85d62f177 (2026-08-26). Data as JSON: /api/errors/f2181a93483d0373. Report an issue: GitHub.