T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/src/core/markdown.ts:21
- Finding
- Arbitrary Server-Side JavaScript Execution Through Untrusted MDX Evaluation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/src/core/markdown.ts:21-53`; exposed through `scripts/src/cli.ts:220` **Vulnerability Type**: Untrusted MDX evaluation **Risk Level**: High ### Vulnerable Code ```ts async function mdxToHtml(markdown: string): Promise<string> { const mdxComponentNames = [...markdown.matchAll(/<([A-Z][A-Za-z0-9_]*)\b/g)].map((match) => match[1]); const fallbackComponents: Record<string, React.ComponentType<Record<string, unknown>>> = {}; for (const componentName of mdxComponentNames) { if (fallbackComponents[componentName]) { continue; } fallbackComponents[componentName] = function UnknownMdxComponent(props: Record<string, unknown> = {}) { const { children } = props; return React.createElement( 'div', { 'data-mdx-component': componentName }, children as React.ReactNode ); }; } const module = (await evaluate(markdown, { Fragment, jsx, jsxs, development: false, remarkPlugins: [remarkGfm] })) as { default: React.ComponentType<Record<string, unknown>> }; const Component = module.default; const html = renderToStaticMarkup( React.createElement(Component, { components: fallbackComponents }) ).trim(); return html.length > 0 ? html : '<p><br></p>'; } ``` The feature is exposed as a normal CLI option: ```ts .option('--mdx-mode', 'Enable mdx mode', false) ``` ### Technical Analysis `@mdx-js/mdx` evaluation is not equivalent to parsing Markdown as inert text. MDX supports executable JavaScript expressions and compiles the supplied document into a JavaScript module. Calling `evaluate()` on content from the input file therefore crosses a code-versus-data boundary. The CLI reads a user-selected file and passes its contents directly into this evaluation path when `--mdx-mode` is enabled. There is no trust check, isolation boundary, sandbox, capability restriction, or validation that limits ...[truncated 1361 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not call `evaluate()` on untrusted or externally supplied MDX. 2. Prefer parsing Markdown as data and support only an explicit allowlist of passive formatting constructs. 3. If MDX support is essential, clearly classify it as a trusted-input-only feature and reject its use for downloaded, shared, or otherwise untrusted documents. 4. Run MDX compilation and rendering in a separate, disposable sandbox with: - No inherited environment variables. - No filesystem access except a read-only input and isolated output directory. - No network access. - No process-spawning capability. - Strict CPU, memory, and execution-time limits. 5. Do not rely on JavaScript language-level sandboxes alone as the primary security boundary. Use operating-system or container isolation. 6. Add negative security tests using MDX expressions that attempt to access runtime globals, environment data, the filesystem, and the network. ]]>