Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

babel/traverse <7.23.2 critical vulnerability #205

Open
boly38 opened this issue Oct 20, 2023 · 0 comments
Open

babel/traverse <7.23.2 critical vulnerability #205

boly38 opened this issue Oct 20, 2023 · 0 comments
Labels
dependencies Pull requests that update a dependency file

Comments

@boly38
Copy link

boly38 commented Oct 20, 2023

Hi
it seems that in order to fix indirect critical issue in deps,
there is a need to update @babel/plugin-transform-runtime to @babel/plugin-transform-runtime@7.23.2 (source)

@babel/traverse  <7.23.2
Severity: critical
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - https://github.com/advisories/GHSA-67hx-6x53-jw92

  └─┬ @babel/plugin-transform-runtime@7.19.6
    └─┬ @babel/core@7.19.6
      ├─┬ @babel/helper-module-transforms@7.19.6
      │ └── @babel/traverse@7.19.6 deduped
      ├─┬ @babel/helpers@7.19.4
      │ └── @babel/traverse@7.19.6 deduped
      └── @babel/traverse@7.19.6

forcing resolution to 7.23.2 fix the issue for me as workaround

@zazoomauro zazoomauro added the dependencies Pull requests that update a dependency file label Jan 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

No branches or pull requests

2 participants