Arbitrary Code Execution Vulnerability in Babel's @babel/traverse Package
Summary
CVE-2023-45133: Babel is a compiler for writingJavaScript. Affects node-babel7 across 4 version ranges.
< 7.12.12+~cs150.141.84-6+deb11u1
< 9944f3680434d6e7c67cd1fe065abef5885c9290
< b4b9942a6cde0685c222eb3412347880aae40ad5
< b13376b346946e3f62fc0848c1d2a23223314c82
Fixed in 7.12.12+~cs150.141.84-6+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Babel is a widely used JavaScript compiler that allows developers to write modern JavaScript code while ensuring compatibility with older environments. The @babel/traverse package is a core component of Babel that enables the traversal and manipulation of the abstract syntax tree (AST) generated during the compilation process. This package is essential for various Babel plugins and presets, which enhance the functionality of Babel by transforming code and adding polyfills. However, certain vulnerabilities in this package can lead to severe security risks, particularly when untrusted code is compiled.
Vulnerability Detail
The vulnerability, identified as CVE-2023-45133, affects the @babel/traverse package prior to versions 7.23.2 and 8.0.0-alpha.4, as well as all versions of babel-traverse. It arises from the use of internal Babel methods path.evaluate() and path.evaluateTruthy() during the compilation of specially crafted code by an attacker. This can lead to arbitrary code execution, especially when using affected plugins such as @babel/plugin-transform-runtime and @babel/preset-env with the useBuiltIns option. Users compiling untrusted code are particularly at risk, as this vulnerability can be exploited to execute malicious code during the compilation process.
How To Fix
Minimum fixed version
7.12.12+~cs150.141.84-6+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-babel7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not feasible, users should avoid compiling untrusted code and ensure that any plugins relying on the vulnerable methods are not used until the upgrade can be performed.
Conclusion
The CVE-2023-45133 vulnerability in Babel's @babel/traverse package poses a serious risk of arbitrary code execution when compiling untrusted code. Users are strongly advised to upgrade to the latest versions of the affected packages and plugins to mitigate this risk. For those unable to upgrade immediately, avoiding the compilation of untrusted code is recommended.
See every vulnerability recorded for node-babel7 →
FAQ
CVE-2023-45133 is a vulnerability in the Babel @babel/traverse package that can lead to arbitrary code execution when compiling untrusted code.
Versions prior to 7.23.2 and 8.0.0-alpha.4, as well as all versions of babel-traverse, are affected by this vulnerability.
Exploitation of this vulnerability can allow an attacker to execute arbitrary code during the compilation process, which poses significant security risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts users in real-time for open-source vulnerabilities in software by analyzing a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for node-babel7.
