CVSS: 6.2EPSS: 0%CPEs: 2EXPL: 0CVE-2025-27789 – Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups
https://notcve.org/view.php?id=CVE-2025-27789
11 Mar 2025 — Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.rep... • https://github.com/babel/babel/pull/17173 • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 9.3EPSS: 0%CPEs: 15EXPL: 0CVE-2023-45133 – Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
https://notcve.org/view.php?id=CVE-2023-45133
12 Oct 2023 — Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyf... • https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82 • CWE-184: Incomplete List of Disallowed Inputs CWE-697: Incorrect Comparison •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-42771 – python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code
https://notcve.org/view.php?id=CVE-2021-42771
20 Oct 2021 — Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution. Babel.Locale en Babel versiones anteriores a 2.9.1, permite a atacantes cargar archivos .dat de configuración regional arbitrarios (que contienen objetos Python serializados) por medio de salto de directorio, lo que conlleva a una ejecución de código A flaw was found in python-babel. A path traversal vulnerability was found in how ... • https://github.com/python-babel/babel/pull/782 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •