CVSS: 6.2EPSS: 0%CPEs: 2EXPL: 0CVE-2025-27789 – Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups
https://notcve.org/view.php?id=CVE-2025-27789
11 Mar 2025 — Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.rep... • https://github.com/babel/babel/pull/17173 • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 9.3EPSS: 0%CPEs: 15EXPL: 0CVE-2023-45133 – Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
https://notcve.org/view.php?id=CVE-2023-45133
12 Oct 2023 — Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyf... • https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82 • CWE-184: Incomplete List of Disallowed Inputs CWE-697: Incorrect Comparison •