What is CVE-2023-45133?

CVE-2023-45133 is a critical vulnerability affecting Babel, a popular JavaScript compiler, specifically the @babel/traverse package and all versions of babel-traverse. This vulnerability allows arbitrary code execution when compiling specifically crafted malicious code, posing a significant risk to systems using Babel for JavaScript compilation. The severity of this vulnerability is rated as high.

Who is impacted by this?

The CVE-2023-45133 vulnerability affects users of Babel, particularly those using @babel/traverse prior to version 7.23.2 or 8.0.0-alpha.4, and all versions of babel-traverse. It also impacts users of plugins like @babel/plugin-transform-runtime, @babel/preset-env with its useBuiltIns option, and any "polyfill provider" plugin that relies on @babel/helper-define-polyfill-provider. This vulnerability can lead to arbitrary code execution during compilation.

What should I do if I’m affected?

If you're affected by the CVE-2023-45133 vulnerability, take the following steps to secure your system:

1. Upgrade @babel/traverse to version 7.23.2 or higher by removing it from the package manager's lockfile and reinstalling the dependencies.

2. If upgrading @babel/traverse is not possible, update the affected plugins to their latest versions.

3. Be cautious when compiling untrusted code and ensure it comes from a trusted source.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

CVE-2023-45133 is not listed in CISA's Known Exploited Vulnerabilities Catalog. To address this vulnerability, users should upgrade their affected packages and exercise caution when compiling untrusted code. The vulnerability, discovered in October 2023, allows arbitrary code execution during compilation when using certain plugins in the Babel JavaScript compiler.

Weakness Enumeration

The weakness enumeration for CVE-2023-45133 is categorized as CWE-697 Incorrect Comparison and CWE-184 Incomplete List of Disallowed Inputs, affecting the Babel JavaScript compiler.

Learn More

CVE-2023-45133 is a critical vulnerability in Babel, a popular JavaScript compiler, that can lead to arbitrary code execution during compilation when using certain plugins. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• NVD - CVE-2023-45133

• GitHub Advisory - babel/babel

• Release v7.23.2 - babel/babel

• Debian Security Announcement - DSA 5528-1