Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

CVE-2023-45133

What is CVE-2023-45133?

A vulnerability in Babel's JavaScript compiler allows for arbitrary code execution when processing specially crafted code during compilation. This occurs specifically in versions of the @babel/traverse library prior to 7.23.2 and 8.0.0-alpha.4, alongside all versions of babel-traverse. Attackers can exploit this vulnerability through plugins that utilize internal Babel methods like path.evaluate() or path.evaluateTruthy(). Affected users should upgrade to secure versions of @babel/traverse and relevant plugins to mitigate risks, especially if they compile untrusted code.

References