# Sky Remote Code Execution Bugfix Review

gray-matter parsed attacker-supplied Markdown with JS engine enabled, letting a crafted .md URL run eval and read /etc/passwd on vote.makerdao.com.

- Payout: $50,000
- Severity: critical
- Program: Sky
- Credited: xss
- Disclosed: 2025-02-25
- Write-up quality: 7/10
- Original: https://immunefi.com/blog/bug-fix-reviews/sky-remote-code-execution-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sky-remote-code-execution-bugfix-review
- Tags: domain:web3 impact:data-leak impact:rce kind:bounty platform:blog platform:immunefi sev:critical tech:nodejs technique:source-review vuln:command-injection vuln:rce

**Target:** vote.makerdao.com proposal/poll creation Markdown URL import
**Root cause:** The app passed user-controlled Markdown fetched from a URL into gray-matter without disabling its JavaScript engine, so gray-matter ran eval on the content.
**Steps:**
1. Create a poll at `https://vote.makerdao.com/polling/create` supplying Markdown URL `https://gist.githubusercontent.com/behroz-immunefi/.../rce.md`
2. The malicious .md contains a `---javascript` front-matter block that gray-matter evals to execute system commands (e.g. `cat /etc/passwd`)
3. Visit `https://vote.makerdao.com/api/polling/all-polls?network=goerli` to read the command output
**How found:** Researcher recognized gray-matter's optional JavaScript engine feature runs eval on front-matter, and that the proposal form auto-fills from a user-supplied Markdown URL, making the input attacker-controlled.
**Exploitation:** Attacker hosts a malicious Markdown file, submits its URL during poll creation so the server fetches and evals it, then retrieves command output via the all-polls API endpoint.
**Insight:** When a target imports user-supplied Markdown/YAML, check whether the parser (gray-matter, js-yaml) has an eval/JS-engine option enabled by default and whether front-matter delimiters like `---javascript` reach it.