<p>There is no fixed version for <code>babel-traverse</code>.</p>

Incomplete List of Disallowed Inputs Affecting babel-traverse package, versions *

Snyk CVSS

Attack Complexity Low

Scope Changed

Confidentiality High

Integrity High

Availability High

Threat Intelligence

Exploit Maturity Proof of concept

EPSS 0.06% (25^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JS-BABELTRAVERSE-5962463
published 13 Oct 2023
disclosed 12 Oct 2023
credit William Khem-Marquez

Report a new vulnerability Found a mistake?

Introduced: 12 Oct 2023

CVE-2023-45133 Open this link in a new tab CWE-184 Open this link in a new tab

How to fix?

There is no fixed version for babel-traverse.

Overview

Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs when using plugins that rely on the path.evaluate() or path.evaluateTruthy() internal Babel methods.

Note:

This is only exploitable if the attacker uses known affected plugins such as @babel/plugin-transform-runtime, @babel/preset-env when using its useBuiltIns option, and any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider. No other plugins under the @babel/ namespace are impacted, but third-party plugins might be.

Users that only compile trusted code are not impacted.

Workaround

Users who are unable to upgrade the library can upgrade the affected plugins instead, to avoid triggering the vulnerable code path in affected @babel/traverse.