CVSS: 9.3EPSS: 0%CPEs: 15EXPL: 0CVE-2023-45133 – Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
https://notcve.org/view.php?id=CVE-2023-45133
Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. • https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82 https://github.com/babel/babel/pull/16033 https://github.com/babel/babel/releases/tag/v7.23.2 https://github.com/babel/babel/releases/tag/v8.0.0-alpha.4 https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92 https://lists.debian.org/debian-lts-announce/2023/10/msg00026.html https://www.debian.org/security/2023/dsa-5528 • CWE-184: Incomplete List of Disallowed Inputs CWE-697: Incorrect Comparison •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-42771 – python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code
https://notcve.org/view.php?id=CVE-2021-42771
Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution. Babel.Locale en Babel versiones anteriores a 2.9.1, permite a atacantes cargar archivos .dat de configuración regional arbitrarios (que contienen objetos Python serializados) por medio de salto de directorio, lo que conlleva a una ejecución de código A flaw was found in python-babel. A path traversal vulnerability was found in how locale data files are checked and loaded within python-babel, allowing a local attacker to trick an application that uses python-babel to load a file outside of the intended locale directory. The highest threat from this vulnerability is to data confidentiality and integrity as well as service availability. • https://github.com/python-babel/babel/pull/782 https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html https://lists.debian.org/debian-lts/2021/10/msg00040.html https://www.debian.org/security/2021/dsa-5018 https://www.tenable.com/security/research/tra-2021-14 https://access.redhat.com/security/cve/CVE-2021-42771 https://bugzilla.redhat.com/show_bug.cgi?id=1955615 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •