CVE-2023-45133: Babel vulnerable to arbitrary code execution
Summary
CVE-2023-45133: Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code. Affects @babel/traverse across 2 version ranges.
< 7.23.2
>= 8.0.0-alpha.0, < 8.0.0-alpha.4
Fixed in 7.23.2 or 8.0.0-alpha.4, depending on the release line you run. How to fix ↓
Also tracked for
- node-babel7 · Debian:11
The same CVE-2023-45133 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Babel is an open-source JavaScript compiler that allows developers to write code using the latest ECMAScript standards and then transpile it into backward-compatible versions of JavaScript. It is widely used in the JavaScript ecosystem to enable the use of modern language features. However, a vulnerability has been discovered in Babel that allows for arbitrary code execution during compilation when processing specifically crafted malicious code. This vulnerability affects certain plugins that rely on internal Babel methods, such as path.evaluate() and path.evaluateTruthy(). The impacted plugins include @babel/plugin-transform-runtime, @babel/preset-env (when using the useBuiltIns option), and various polyfill provider plugins. It is important to note that this vulnerability only affects users who compile untrusted code.
Vulnerability Detail
The vulnerability in Babel arises from a code execution flaw during compilation. If an attacker crafts malicious code and it is compiled using Babel with one of the affected plugins, it can lead to arbitrary code execution. This occurs due to the usage of the vulnerable path.evaluate() and path.evaluateTruthy() methods within the affected plugins. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary code during the compilation process. It is crucial for users to be cautious when compiling untrusted code with Babel and the affected plugins.
How To Fix
Latest published version: 8.0.7 as of 22 Oct 2026
npm install @babel/traverse@8.0.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 7.23.27.23.2npm install @babel/traverse@7.23.2 -
>= 8.0.0-alpha.0, < 8.0.0-alpha.48.0.0-alpha.4npm install @babel/traverse@8.0.0-alpha.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading @babel/traverse and the affected plugins is not feasible, users can implement the following workaround to mitigate the vulnerability: Avoid compiling untrusted code with Babel and the affected plugins. By only compiling trusted code, users can prevent the execution of arbitrary code during the compilation process.
Conclusion
In conclusion, Babel is vulnerable to arbitrary code execution when compiling specifically crafted malicious code. This vulnerability can have severe consequences, allowing attackers to execute arbitrary code during the compilation process. Users are advised to upgrade their @babel/traverse package and any affected plugins to their latest versions. If upgrading is not possible, it is crucial to avoid compiling untrusted code with Babel and the affected plugins. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @babel/traverse →
FAQ
The vulnerability affects the following plugins: @babel/plugin-transform-runtime, @babel/preset-env (when using the useBuiltIns option), and various polyfill provider plugins that depend on @babel/helper-define-polyfill-provider, such as babel-plugin-polyfill-corejs3, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-es-shims, and babel-plugin-polyfill-regenerator.
No, only the plugins mentioned in the previous answer are impacted. However, it is possible that third-party plugins may also be affected, so it is important to stay updated and follow security advisories.
If you only compile trusted code, you are not impacted by this vulnerability. However, it is still recommended to stay updated with security patches and follow best practices to ensure the security of your codebase.
No, Babel 6 does not receive security fixes anymore. The vulnerability has been fixed in @babel/traverse@7.23.2 and upgrading to this version is the recommended solution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file without requiring access to the code or installation.
