CVE-2023-45133
Description
Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/[email protected]` and `@babel/[email protected]`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.
How to fix
- babeljs babel7.23.2 or later
- babeljs babel-helper-define-polyfill-provider0.4.3 or later
- babeljs babel-plugin-polyfill-corejs20.4.6 or later
- babeljs babel-plugin-polyfill-corejs30.8.5 or later
- babeljs babel-plugin-polyfill-es-shims0.10.0 or later
- babeljs babel-plugin-polyfill-regenerator0.5.3 or later
- babeljs babel-plugin-transform-runtime7.23.2 or later
- babeljs babel-preset-env7.23.2 or later
- @babel/traverse7.23.2, 8.0.0-alpha.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| babeljs babel | v < 7.23.2, 8.0.0 | 7.23.2 |
| debian debian_linux | 10.0, 11.0, 12.0 | — |
| babeljs babel-helper-define-polyfill-provider | v < 0.4.3 | 0.4.3 |
| babeljs babel-plugin-polyfill-corejs2 | v < 0.4.6 | 0.4.6 |
| babeljs babel-plugin-polyfill-corejs3 | v < 0.8.5 | 0.8.5 |
| babeljs babel-plugin-polyfill-es-shims | v < 0.10.0 | 0.10.0 |
| babeljs babel-plugin-polyfill-regenerator | v < 0.5.3 | 0.5.3 |
| babeljs babel-plugin-transform-runtime | v < 7.23.2 | 7.23.2 |
| babeljs babel-preset-env | v < 7.23.2 | 7.23.2 |
| @babel/traversenpm | v < 7.23.2, 8.0.0-alpha.0 ≤ v < 8.0.0-alpha.4 | 7.23.2, 8.0.0-alpha.4 |
| babel-traversenpm | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.