gatsbyjs/gatsby · error

You have frontmatter declared with "---js" or "---javascript

Error message

You have frontmatter declared with "---js" or "---javascript" that is not parsed by default to mitigate a security risk (see https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcw). If you require this feature it can be enabled by setting "jsFrontmatterEngine: true" in the plugin options of gatsby-transformer-remark.

What it means

Error "You have frontmatter declared with "---js" or "---javascript" that is not parsed by default to mitigate a security risk (see https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcw). If you require this feature it can be enabled by setting "jsFrontmatterEngine: true" in the plugin options of gatsby-transformer-remark." thrown in gatsbyjs/gatsby.

Source

Thrown at packages/gatsby-transformer-remark/src/gatsby-node.js:45

      .description(
        `Enable JS for https://github.com/jonschlinkert/gray-matter#optionsengines`
      ),
  }).custom(value => {
    const { jsFrontmatterEngine, engines = {} } = value || {}

    if (jsFrontmatterEngine) {
      // show this warning only once in main process
      if (!process.env.GATSBY_WORKER_ID) {
        console.warn(
          `JS frontmatter engine is enabled in gatsby-transformer-remark (via jsFrontmatterEngine: true). This can cause a security risk, see https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcw. If you are not relying on this feature we strongly suggest disabling it via the "jsFrontmatterEngine: false" plugin option. If you rely on this feature make sure to properly secure or sanitize your content source.`
        )
      }
      return value
    }

    const js = () => {
      if (!warnedAboutJSFrontmatterEngine) {
        console.warn(
          `You have frontmatter declared with "---js" or "---javascript" that is not parsed by default to mitigate a security risk (see https://github.com/gatsbyjs/gatsby/security/advisories/GHSA-7ch4-rr99-cqcw). If you require this feature it can be enabled by setting "jsFrontmatterEngine: true" in the plugin options of gatsby-transformer-remark.`
        )
        warnedAboutJSFrontmatterEngine = true
      }
      // we still have to return a frontmatter, so we just stub it with empty object
      return {}
    }

    return {
      ...value,
      engines: {
        ...engines,
        js,
        javascript: js,
      },
    }
  })
}

View on GitHub (pinned to e85d62f177)

Solutions

1. Convert the `---js`/`---javascript` frontmatter block to plain YAML `---` frontmatter if you don't need JS evaluation
2. If JS frontmatter is required, opt in explicitly with jsFrontmatterEngine: true and ensure the markdown source is trusted/sanitized (GHSA-7ch4-rr99-cqcw)
3. The affected field will simply be unparsed/skipped until the engine is enabled

When it happens

Trigger: Thrown at packages/gatsby-transformer-remark/src/gatsby-node.js:45 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gatsbyjs/gatsby@e85d62f177 (2026-08-26). Data as JSON: /api/errors/559058c273f4bead. Report an issue: GitHub.