babel: Incorrect Comparison
CVE-2023-45133 is a high-severity incorrect comparison vulnerability in babel, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. Affected babel versions: < 7.23.2; >= 8.0.0-alpha.0, < 8.0.0-alpha.4. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.53% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Babel-helper-define-polyfill-provider to 0.4.3 or a later version.
- Update Babel-plugin-polyfill-corejs2 to 0.4.6 or a later version.
- Update Babel-plugin-polyfill-corejs3 to 0.8.5 or a later version.
- Read the advisory on github.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Babel | babel | < 7.23.2; >= 8.0.0-alpha.0, < 8.0.0-alpha.4 | Not stated |
| Debian | Debian Linux | 10.0; 11.0; 12.0 | Not stated |
| Babeljs | Babel-helper-define-polyfill-provider | before 0.4.3 | 0.4.3 |
| Babeljs | Babel-plugin-polyfill-corejs2 | before 0.4.6 | 0.4.6 |
| Babeljs | Babel-plugin-polyfill-corejs3 | before 0.8.5 | 0.8.5 |
| Babeljs | Babel-plugin-polyfill-es-shims | before 0.10.0 | 0.10.0 |
| Babeljs | Babel-plugin-polyfill-regenerator | before 0.5.3 | 0.5.3 |
| Babeljs | Babel-plugin-transform-runtime | before 7.23.2 | 7.23.2 |
| Babeljs | Babel-preset-env | before 7.23.2 | 7.23.2 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 9.3 | Critical | CNA (github.com) |
| CVSS 3.1 | 8.8 | High | NVD |
Official description
Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/[email protected]` and `@babel/[email protected]`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Advisories
- github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92Third Party Advisory
Patches and release notes
Third-party and government advisories
- lists.debian.org/debian-lts-announce/2023/10/msg00026.htmlMailing List, Third Party Advisory
Other references
- debian.org/security/2023/dsa-5528Issue Tracking
Other vulnerabilities in babel
- 7.8 High severity
Recent Incorrect Comparison vulnerabilities
- 7.2 High severity
- 7.2 High severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 7.1 High severity
Spotted an error? Tell us.