| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| babel | = 8.0.0≥ 7.12.0, < 7.29.4 | 7.29.4 |
| @babel/plugin-transform-modules-systemjs | ≥ 7.12.0, < 7.29.4≥ 8.0.0-alpha.0, < 8.0.0-alpha.13 | 7.29.48.0.0-alpha.13 |
Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code.
Known affected plugins are:
@babel/plugin-transform-modules-systemjs@babel/preset-env when using the modules: "systemjs" option, as it delegates to @babel/plugin-transform-modules-systemjsNo other plugins under the @babel namespace are impacted.
Users that only compile trusted code are not impacted.
The vulnerability has been fixed in @babel/[email protected].
Babel also released @babel/[email protected], updating its @babel/plugin-transform-modules-systemjs dependency, to simplify forcing the update if you are using @babel/preset-env directly.
@babel/parser to v7.11.5. The downgrade will completely disable string module name parsing, but it would also disable other new language features and the build pipeline may fail as a result. Only do so if you are working on a legacy codebase and can not upgrade @babel/plugin-transform-modules-systemjs to v7.29.4.modules: "systemjs" option, migrate the codebase to native ES Modules or any other module formats.Babel thanks Daniel Cervera for reporting the vulnerability.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí