CVE-2023-45133

Aliases:GHSA-67hx-6x53-jw92
Advisory lineage Upstream: 0 Downstream: 6
Modified
Published: 12 Oct 2023, 16:17
Last modified:13 Feb 2025, 17:13

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.4 CRITICAL
v3.1 (cve.org)
EPSS Score
0.09% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

12 Oct 2023, 16:17
Published
Vulnerability first disclosed
13 Feb 2025, 17:13
Last Modified
Vulnerability information updated

Description

Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  • v3.1•HIGH•Score: 8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.09%• Percentile: 26%

Techniques & Countermeasures

  • CWE-184•Incomplete List of Disallowed Inputs

    The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

  • CWE-697•Incorrect Comparison

    The product compares two entities in a security-relevant context, but the comparison is incorrect.

Affected Systems

  • babel•babel

    < 7.23.2 | ≥ 8.0.0-alpha.0, < 8.0.0-alpha.4

  • babeljs•babel

    < 7.23.2 | 8.0.0:alpha.0 | 8.0.0:alpha.1 | 8.0.0:alpha.2 | 8.0.0:alpha.3

  • babeljs•babel-helper-define-polyfill-provider

    < 0.4.3

  • babeljs•babel-plugin-polyfill-corejs2

    < 0.4.6

  • babeljs•babel-plugin-polyfill-corejs3

    < 0.8.5

  • babeljs•babel-plugin-polyfill-es-shims

    < 0.10.0

  • babeljs•babel-plugin-polyfill-regenerator

    < 0.5.3

  • babeljs•babel-plugin-transform-runtime

    < 7.23.2

  • babeljs•babel-preset-env

    < 7.23.2

  • debian•debian_linux

    10.0 | 11.0 | 12.0

  • Npm•babel-traverse

    all

  • @babel•traverse

    < 7.23.2 | ≥ 8.0.0-alpha.0, < 8.0.0-alpha.4

References (10)