9.3 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
25.7%
Babel is a compiler for writingJavaScript. In @babel/traverse
prior to
versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse
,
using Babel to compile code that was specifically crafted by an attacker
can lead to arbitrary code execution during compilation, when using plugins
that rely on the path.evaluate()
or path.evaluateTruthy()
internal Babel
methods. Known affected plugins are @babel/plugin-transform-runtime
;
@babel/preset-env
when using its useBuiltIns
option; and any โpolyfill
providerโ plugin that depends on @babel/helper-define-polyfill-provider
,
such as babel-plugin-polyfill-corejs3
, babel-plugin-polyfill-corejs2
,
babel-plugin-polyfill-es-shims
, babel-plugin-polyfill-regenerator
. No
other plugins under the @babel/
namespace are impacted, but third-party
plugins might be. Users that only compile trusted code are not impacted.
The vulnerability has been fixed in @babel/[email protected]
and
@babel/[email protected]
. Those who cannot upgrade @babel/traverse
and are using one of the affected packages mentioned above should upgrade
them to their latest version to avoid triggering the vulnerable code path
in affected @babel/traverse
versions: @babel/plugin-transform-runtime
v7.23.2, @babel/preset-env
v7.23.2,
@babel/helper-define-polyfill-provider
v0.4.3,
babel-plugin-polyfill-corejs2
v0.4.6, babel-plugin-polyfill-corejs3
v0.8.5, babel-plugin-polyfill-es-shims
v0.10.0,
babel-plugin-polyfill-regenerator
v0.5.3.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | node-babel | <ย any | UNKNOWN |
ubuntu | 20.04 | noarch | node-babel | <ย any | UNKNOWN |
ubuntu | 22.04 | noarch | node-babel7 | <ย any | UNKNOWN |
ubuntu | 23.10 | noarch | node-babel7 | <ย any | UNKNOWN |
ubuntu | 24.04 | noarch | node-babel7 | <ย any | UNKNOWN |
github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82
github.com/babel/babel/pull/16033
github.com/babel/babel/releases/tag/v7.23.2
github.com/babel/babel/releases/tag/v8.0.0-alpha.4
github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92
launchpad.net/bugs/cve/CVE-2023-45133
lists.debian.org/debian-lts-announce/2023/10/msg00026.html
nvd.nist.gov/vuln/detail/CVE-2023-45133
security-tracker.debian.org/tracker/CVE-2023-45133
www.cve.org/CVERecord?id=CVE-2023-45133
www.debian.org/security/2023/dsa-5528