Babel is a compiler for writingJavaScript. In @babel/traverse
prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse
, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluate()
or path.evaluateTruthy()
internal Babel methods. Known affected plugins are @babel/plugin-transform-runtime
; @babel/preset-env
when using its useBuiltIns
option; and any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider
, such as babel-plugin-polyfill-corejs3
, babel-plugin-polyfill-corejs2
, babel-plugin-polyfill-es-shims
, babel-plugin-polyfill-regenerator
. No other plugins under the @babel/
namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in @babel/traverse@7.23.2
and @babel/traverse@8.0.0-alpha.4
. Those who cannot upgrade @babel/traverse
and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected @babel/traverse
versions: @babel/plugin-transform-runtime
v7.23.2, @babel/preset-env
v7.23.2, @babel/helper-define-polyfill-provider
v0.4.3, babel-plugin-polyfill-corejs2
v0.4.6, babel-plugin-polyfill-corejs3
v0.8.5, babel-plugin-polyfill-es-shims
v0.10.0, babel-plugin-polyfill-regenerator
v0.5.3.
{ "binaries": [ { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-cli" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-code-frame" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-core" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-generator" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helper-bindify-decorators" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helper-builder-binary-assignment-operator-visitor" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helper-builder-react-jsx" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helper-call-delegate" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helper-define-map" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helper-explode-assignable-expression" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helper-explode-class" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helper-function-name" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helper-get-function-arity" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helper-hoist-variables" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helper-optimise-call-expression" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helper-regex" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helper-remap-async-to-generator" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helper-replace-supers" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-helpers" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-messages" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-external-helpers" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-syntax-async-functions" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-syntax-async-generators" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-syntax-class-constructor-call" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-syntax-class-properties" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-syntax-decorators" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-syntax-do-expressions" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-syntax-dynamic-import" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-syntax-exponentiation-operator" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-syntax-export-extensions" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-syntax-flow" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-syntax-function-bind" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-syntax-jsx" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-syntax-object-rest-spread" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-syntax-trailing-function-commas" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-async-generator-functions" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-async-to-generator" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-class-constructor-call" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-class-properties" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-decorators" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-do-expressions" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-es3-member-expression-literals" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-es3-property-literals" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-exponentiation-operator" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-export-extensions" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-flow-strip-types" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-function-bind" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-jscript" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-object-rest-spread" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-proto-to-assign" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-react-display-name" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-react-jsx" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-react-jsx-self" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-react-jsx-source" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-regenerator" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-runtime" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-plugin-transform-strict-mode" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-polyfill" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-preset-es2015" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-preset-es2016" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-preset-es2017" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-preset-flow" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-preset-latest" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-preset-react" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-preset-stage-0" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-preset-stage-1" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-preset-stage-2" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-preset-stage-3" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-register" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-runtime" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-template" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-traverse" }, { "binary_version": "6.26.0+dfsg-3build6", "binary_name": "node-babel-types" } ] }
{ "binaries": [ { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-cli" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-code-frame" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-core" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-generator" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helper-bindify-decorators" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helper-builder-binary-assignment-operator-visitor" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helper-builder-react-jsx" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helper-call-delegate" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helper-define-map" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helper-explode-assignable-expression" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helper-explode-class" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helper-function-name" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helper-get-function-arity" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helper-hoist-variables" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helper-optimise-call-expression" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helper-regex" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helper-remap-async-to-generator" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helper-replace-supers" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-helpers" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-messages" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-external-helpers" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-syntax-async-functions" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-syntax-async-generators" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-syntax-class-constructor-call" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-syntax-class-properties" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-syntax-decorators" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-syntax-do-expressions" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-syntax-dynamic-import" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-syntax-exponentiation-operator" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-syntax-export-extensions" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-syntax-flow" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-syntax-function-bind" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-syntax-jsx" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-syntax-object-rest-spread" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-syntax-trailing-function-commas" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-async-generator-functions" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-async-to-generator" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-class-constructor-call" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-class-properties" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-decorators" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-do-expressions" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-es3-member-expression-literals" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-es3-property-literals" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-exponentiation-operator" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-export-extensions" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-flow-strip-types" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-function-bind" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-jscript" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-object-rest-spread" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-proto-to-assign" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-react-display-name" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-react-jsx" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-react-jsx-self" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-react-jsx-source" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-regenerator" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-runtime" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-plugin-transform-strict-mode" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-polyfill" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-preset-es2015" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-preset-es2016" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-preset-es2017" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-preset-flow" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-preset-latest" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-preset-react" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-preset-stage-0" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-preset-stage-1" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-preset-stage-2" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-preset-stage-3" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-register" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-runtime" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-template" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-traverse" }, { "binary_version": "6.26.0+repack-3", "binary_name": "node-babel-types" } ] }
{ "binaries": [ { "binary_version": "7.20.15+ds1+~cs214.269.168-6build1", "binary_name": "node-babel7" }, { "binary_version": "7.20.15+ds1+~cs214.269.168-6build1", "binary_name": "node-babel7-debug" }, { "binary_version": "7.20.15+ds1+~cs214.269.168-6build1", "binary_name": "node-babel7-runtime" }, { "binary_version": "7.20.15+ds1+~cs214.269.168-6build1", "binary_name": "node-babel7-standalone" } ] }