CVE-2023-45133
CVSS 3.1 Score 9.3 of 10 (high)
Details
Summary
CVE-2023-45133 is a critical vulnerability in Babel, a JavaScript compiler. The vulnerability affects the `@babel/traverse` module prior to versions 7.23.2 and 8.0.0-alpha.4, as well as all versions of `babel-traverse`. It can be exploited by an attacker through specifically crafted code to execute arbitrary code during compilation when using plugins that rely on the `path.evaluate()` or `path.evaluateTruthy()` methods. Notable affected plugins include `@babel/plugin-transform-runtime` and `@babel/preset-env` with the `useBuiltIns` option, as well as certain "polyfill provider" plugins such as `babel-plugin-polyfill-corejs3`. The issue has been addressed in the fixed versions of `@babel/traverse`. Organizations that only compile trusted code are not impacted. The vulnerability has a base severity rating of CRITICAL, with a base score of 9.3 according to CVSS:3.1.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions