USN-9054-1: node-babel vulnerability
It was discovered that Babel incorrectly evaluated certain code during compilation when used with certain plugins. If a user or an automated system were tricked into compiling specially crafted code, an attacker could possibly use this issue to execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/node-babelto a version that resolves this vulnerability.Fixed in 6.26.0+dfsg-3ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/node-babelto a version that resolves this vulnerability.Fixed in 6.26.0+repack-3ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/node-babel-traverseto a version that resolves this vulnerability.Fixed in Ubuntu Pro
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users or automated systems that compile untrusted or attacker-supplied code with node-babel may be exposed, particularly when using the affected plugins. The issue can lead to arbitrary code execution during compilation.
What must an attacker do to exploit it?
An attacker needs to cause a user or automated system to compile specially crafted code using node-babel with the relevant plugin conditions. This may involve tricking the target into compiling the crafted input.