CVE-2023-45133

CVE-2023-45133 is an arbitrary code execution vulnerability in Babel's @babel/traverse component, affecting Babel versions prior to 7.23.2 and 8.0.0-alpha.4, as well as specific plugins like @babel/plugin-transform-runtime and @babel/preset-env. An attacker can craft malicious JavaScript code that, when compiled by Babel using vulnerable plugins, leads to arbitrary code execution during the compilation process. This vulnerability carries a high severity CVSS score of 8.8, indicating a significant risk. The attack vector is local, requiring the attacker to provide specially crafted code for compilation, but the impact includes high confidentiality, integrity, and availability compromise. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. However, the vulnerability has garnered community discussion and media coverage, suggesting awareness within the cybersecurity community.