@tinacms/graphql 2.0.2 → 2.0.3

package/dist/index.js

@@ -3026,7 +3026,7 @@ var validateField = async (field) => {
 var package_default = {
   name: "@tinacms/graphql",
   type: "module",
-  version: "2.0.2",
+  version: "2.0.3",
   main: "dist/index.js",
   module: "./dist/index.js",
   files: [
@@ -3504,6 +3504,56 @@ var matterEngines = {
   toml: {
     parse: (val) => toml.parse(val),
     stringify: (val) => toml.stringify(val)
+  },
+  // Disable JavaScript and CoffeeScript execution to prevent code execution vulnerability (CVE)
+  // gray-matter executes JS/Coffee code by default, which is a security risk
+  js: {
+    parse: () => {
+      throw new Error(
+        "JavaScript execution in frontmatter is not allowed for security reasons"
+      );
+    },
+    stringify: () => {
+      throw new Error(
+        "JavaScript execution in frontmatter is not allowed for security reasons"
+      );
+    }
+  },
+  javascript: {
+    parse: () => {
+      throw new Error(
+        "JavaScript execution in frontmatter is not allowed for security reasons"
+      );
+    },
+    stringify: () => {
+      throw new Error(
+        "JavaScript execution in frontmatter is not allowed for security reasons"
+      );
+    }
+  },
+  coffee: {
+    parse: () => {
+      throw new Error(
+        "CoffeeScript execution in frontmatter is not allowed for security reasons"
+      );
+    },
+    stringify: () => {
+      throw new Error(
+        "CoffeeScript execution in frontmatter is not allowed for security reasons"
+      );
+    }
+  },
+  coffeescript: {
+    parse: () => {
+      throw new Error(
+        "CoffeeScript execution in frontmatter is not allowed for security reasons"
+      );
+    },
+    stringify: () => {
+      throw new Error(
+        "CoffeeScript execution in frontmatter is not allowed for security reasons"
+      );
+    }
   }
 };
 var stringifyFile = (content, format, keepTemplateKey, markdownParseConfig) => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tinacms/graphql",
   "type": "module",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "main": "dist/index.js",
   "module": "./dist/index.js",
   "files": [
@@ -71,8 +71,8 @@
     "vite": "^4.5.9",
     "vitest": "^0.32.4",
     "zod": "^3.24.2",
-    "@tinacms/scripts": "1.4.2",
-    "@tinacms/schema-tools": "2.1.0"
+    "@tinacms/schema-tools": "2.1.0",
+    "@tinacms/scripts": "1.4.2"
   },
   "scripts": {
     "types": "pnpm tsc",