CVE-2023-45133:
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
9.4
Basic Information
JavaScriptTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @babel/traverse | npm | < 7.23.2 | 7.23.2 |
| @babel/traverse | npm | >= 8.0.0-alpha.0, < 8.0.0-alpha.4 | 8.0.0-alpha.4 |
| babel-traverse | npm | < 7.23.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The primary vulnerable function is _evaluate in packages/babel-traverse/src/path/evaluation.ts. The patch directly modifies this function to add a check for hasOwnProperty, preventing the evaluation of methods from an object's prototype chain. The vulnerability description explicitly names path.evaluate() and path.evaluateTruthy() as the internal Babel methods that, when used by plugins, can lead to arbitrary code execution. The packages/babel-traverse/src/path/index.ts file shows that these methods are part of the NodePath class and are imported from NodePath_evaluation, which contains _evaluate. Therefore, NodePath.evaluate and NodePath.evaluateTruthy are the user-facing functions that trigger the vulnerable code in _evaluate. The confidence is high because the patch directly points to _evaluate, and the advisory explicitly mentions the other two methods as the means by which the vulnerability is triggered.