Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

🗓️ 16 Oct 2023 13:55:36Reported by GitHub Advisory DatabaseType

Babel vulnerability allows arbitrary code execution during compilatio

Reporter	Title	Published	Views	Family All 89
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Babel	29 Nov 202314:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion may be vulnerable to Injection, Regular Expression Denial of Service (ReDoS), and Arbitrary Code Execution and via use of postcss, semver, babel-traverse (CVE-2023-45133, CVE-2022-25883, CVE-2023-44270)	16 Nov 202321:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities	14 Feb 202418:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses traverse-7.20.13.tgz which is vulnerable to CVE-2023-45133	19 Feb 202411:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data	2 Jan 202418:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Network Threat Analytics app for IBM QRadar SIEM includes components with known vulnerabilities	22 Jul 202515:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	3 Jan 202413:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion HCI may be vulnerable to Injection, Regular Expression Denial of Service (ReDoS), and Arbitrary Code Execution and via use of postcss, semver, babel-traverse (CVE-2023-45133, CVE-2022-25883, CVE-2023-44270)	21 Dec 202317:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect is vulnerable to using components with known vulnerabilities	15 Apr 202502:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.4 fixes multiple security vulnerabilities	15 Dec 202314:31	–	ibm

Vulners

Node

babel-traverseRange<7.23.2npm

babel traverseRange8.0.0-alpha.0–8.0.0-alpha.4npm

babel traverseRange<7.23.2npm

Source	Link
github	www.github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-45133
github	www.github.com/babel/babel/pull/16033
github	www.github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82
github	www.github.com/babel/babel/releases/tag/v7.23.2
github	www.github.com/babel/babel/releases/tag/v8.0.0-alpha.4
debian	www.debian.org/security/2023/dsa-5528
lists	www.lists.debian.org/debian-lts-announce/2023/10/msg00026.html
babeljs	www.babeljs.io/blog/2023/10/16/cve-2023-45133
github	www.github.com/advisories/GHSA-67hx-6x53-jw92

04 Apr 2024 14:26Current

7.1High risk

Vulners AI Score7.1

CVSS 3.18.8 - 9.3

EPSS0.00093

SSVC