CVE-2023-45133 – Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

https://notcve.org/view.php?id=CVE-2023-45133

12 Oct 2023 — Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyf... • https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82 • CWE-184: Incomplete List of Disallowed Inputs CWE-697: Incorrect Comparison •