Description
Using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluate()or path.evaluateTruthy() internal Babel methods.
Recommendation
Update the @babel/traverse package to the latest compatible version. Followings are version details:
Affected version(s): **>= 8.0.0-alpha.0, < 8.0.0-alpha.4 < 7.23.2** Patched version(s): **8.0.0-alpha.4 7.23.2**
References
Could your website be exposed too?
SmartScanner can check your website for Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input - CVE-2026-44728
- Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin - CVE-2023-22621
- Vega vulnerable to arbitrary code execution when clicking href links - Vulnerability
- PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF - CVE-2024-4367
You might also like:
See something that needs correcting? Let us knowUpdated April 04, 2024