Last tested: 18 Feb, 2018

babel vulnerabilities

Turn ES6 code into readable vanilla ES5 with source maps

View on npm

babel (latest)

Published 17 Feb, 2018

Known vulnerabilities0
Vulnerable paths0
Dependencies0

No known vulnerabilities in babel

Security wise, babel seems to be a safe package to use.
Over time, new vulnerabilities may be disclosed on babel and other packages. To easily find, fix and prevent such vulnerabilties, protect your repos with Snyk!

Vulnerable versions of babel

Fixed in 6.0.0

Prototype Pollution

low severity

Detailed paths

  • Introduced through: babel@5.8.38 > chokidar@1.7.0 > fsevents@1.1.3 > node-pre-gyp@0.6.39 > hawk@3.1.3 > hoek@2.16.3
  • Introduced through: babel@5.8.38 > chokidar@1.7.0 > fsevents@1.1.3 > node-pre-gyp@0.6.39 > hawk@3.1.3 > boom@2.10.1 > hoek@2.16.3
  • Introduced through: babel@5.8.38 > chokidar@1.7.0 > fsevents@1.1.3 > node-pre-gyp@0.6.39 > hawk@3.1.3 > cryptiles@2.0.5 > boom@2.10.1 > hoek@2.16.3
  • Introduced through: babel@5.8.38 > chokidar@1.7.0 > fsevents@1.1.3 > node-pre-gyp@0.6.39 > request@2.81.0 > hawk@3.1.3 > cryptiles@2.0.5 > boom@2.10.1 > hoek@2.16.3
  • Introduced through: babel@5.8.38 > chokidar@1.7.0 > fsevents@1.1.3 > node-pre-gyp@0.6.39 > request@2.81.0 > hawk@3.1.3 > boom@2.10.1 > hoek@2.16.3
  • Introduced through: babel@5.8.38 > chokidar@1.7.0 > fsevents@1.1.3 > node-pre-gyp@0.6.39 > hawk@3.1.3 > sntp@1.0.9 > hoek@2.16.3
  • Introduced through: babel@5.8.38 > chokidar@1.7.0 > fsevents@1.1.3 > node-pre-gyp@0.6.39 > request@2.81.0 > hawk@3.1.3 > sntp@1.0.9 > hoek@2.16.3
  • Introduced through: babel@5.8.38 > chokidar@1.7.0 > fsevents@1.1.3 > node-pre-gyp@0.6.39 > request@2.81.0 > hawk@3.1.3 > hoek@2.16.3

Overview

hoek is a Utility methods for the hapi ecosystem.

Affected versions of this package are vulnerable to Prototype Pollution. The utilities function allow modification of the Object prototype. If an attacker can control part of the structure passed to this function, they could add or modify an existing property.

Remediation

Upgrade hoek to versions 4.2.1, 5.0.3 or higher.

References

Regular Expression Denial of Service (DoS)

high severity

Detailed paths

  • Introduced through: babel@5.8.38 > babel-core@5.8.38 > minimatch@2.0.10

Overview

minimatch is a minimalistic matching library used for converting glob expressions into JavaScript RegExp objects. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Many Regular Expression implementations may reach edge cases that causes them to work very slowly (exponentially related to input size), allowing an attacker to exploit this and can cause the program to enter these extreme situations by using a specially crafted input and cause the service to excessively consume CPU, resulting in a Denial of Service.

An attacker can provide a long value to the minimatch function, which nearly matches the pattern being matched. This will cause the regular expression matching to take a long time, all the while occupying the event loop and preventing it from processing other requests and making the server unavailable (a Denial of Service attack).

You can read more about Regular Expression Denial of Service (ReDoS) on our blog.

Remediation

Upgrade minimatch to version 3.0.2 or greater.

References

Prototype Pollution

low severity

Detailed paths

  • Introduced through: babel@5.8.38 > lodash@3.10.1
  • Introduced through: babel@5.8.38 > babel-core@5.8.38 > lodash@3.10.1
  • Introduced through: babel@5.8.38 > babel-core@5.8.38 > babel-plugin-proto-to-assign@1.0.4 > lodash@3.10.1

Overview

lodash is a javaScript utility library delivering modularity, performance & extras.

Affected versions of this package are vulnerable to Prototype Pollution. The utilities function allow modification of the Object prototype. If an attacker can control part of the structure passed to this function, they could add or modify an existing property.

Remediation

Upgrade lodash to version 4.17.5 or higher.

References