CVE-2023-45133: 
JavaScript vulnerability analysis and mitigation

CVE-2023-45133 affects Babel, a popular JavaScript compiler. The vulnerability was discovered in @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse. The issue allows attackers to execute arbitrary code during compilation when using specific plugins that rely on the path.evaluate() or path.evaluateTruthy() internal Babel methods (GitHub Advisory).

The vulnerability exists in Babel's code evaluation mechanism when using certain plugins. The affected components include @babel/plugin-transform-runtime, @babel/preset-env (when using its useBuiltIns option), and any polyfill provider plugin that depends on @babel/helper-define-polyfill-provider. The vulnerability has received a CVSS v3.1 base score of 9.3 (Critical) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating high severity across confidentiality, integrity, and availability impacts (GitHub Advisory, NVD).

When exploited, this vulnerability can lead to arbitrary code execution during the compilation process when using Babel to compile specifically crafted malicious code. The impact is particularly severe for systems that compile untrusted code, while users that only compile trusted code are not affected (GitHub Advisory).

The vulnerability has been patched in @babel/traverse version 7.23.2 and 8.0.0-alpha.4. Users are advised to upgrade @babel/traverse to v7.23.2 or higher. For those unable to upgrade @babel/traverse immediately, updating to the latest versions of affected packages is recommended: @babel/plugin-transform-runtime v7.23.2, @babel/preset-env v7.23.2, @babel/helper-define-polyfill-provider v0.4.3, babel-plugin-polyfill-corejs2 v0.4.6, babel-plugin-polyfill-corejs3 v0.8.5, babel-plugin-polyfill-es-shims v0.10.0, and babel-plugin-polyfill-regenerator v0.5.3 (GitHub Advisory).

The vulnerability has received attention from major Linux distributions, with Debian releasing security updates for both stable and oldstable distributions. Debian has issued DSA-5528-1 and DLA-3618-1 to address this vulnerability in their node-babel7 and node-babel packages respectively (Debian Security, Debian LTS).