| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| babel | = 8.0.0≥ 7.12.0, < 7.29.4 | 7.29.4 |
| @babel/plugin-transform-modules-systemjs | ≥ 7.12.0, < 7.29.4≥ 8.0.0-alpha.0, < 8.0.0-alpha.13 | 7.29.48.0.0-alpha.13 |
Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code.
Known affected plugins are:
@babel/plugin-transform-modules-systemjs@babel/preset-env when using the modules: "systemjs" option, as it delegates to @babel/plugin-transform-modules-systemjsNo other plugins under the @babel namespace are impacted.
Users that only compile trusted code are not impacted.
The vulnerability has been fixed in @babel/[email protected].
Babel also released @babel/[email protected], updating its @babel/plugin-transform-modules-systemjs dependency, to simplify forcing the update if you are using @babel/preset-env directly.
@babel/parser to v7.11.5. The downgrade will completely disable string module name parsing, but it would also disable other new language features and the build pipeline may fail as a result. Only do so if you are working on a legacy codebase and can not upgrade @babel/plugin-transform-modules-systemjs to v7.29.4.modules: "systemjs" option, migrate the codebase to native ES Modules or any other module formats.Babel thanks Daniel Cervera for reporting the vulnerability.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン