Dependabot Alert: Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

[JennaySDavis]

Impact Using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluate()or path.evaluateTruthy() internal Babel methods.

Known affected plugins are:

@babel/plugin-transform-runtime @babel/preset-env when using its useBuiltIns option Any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider, such as babel-plugin-polyfill-corejs3, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-es-shims, babel-plugin-polyfill-regenerator No other plugins under the @babel/ namespace are impacted, but third-party plugins might be.

Users that only compile trusted code are not impacted.

Patches The vulnerability has been fixed in @babel/traverse@7.23.2.

Babel 6 does not receive security fixes anymore (see Babel's security policy), hence there is no patch planned for babel-traverse@6.

[JennaySDavis]

#464 Acceptance Criteria

Pass/Fail	Description
Pass	Smoke Testing of Training app.

Comments/Additional Notes Performance score will increase when https://github.com/orgs/GSA/projects/43/views/1?pane=issue&itemId=46203471 is completed. A link checker was completed on the app. No broken links were found.

ADA Compliance (Automated scan via Chrome Lighthouse)	Criteria	Score
Performance	96*
Accessibility	100
Best Practices	100

*average several scans were completed

Passed 02/2/2024 - JSD

[LoraBradford]

Thank you! Approved with the understanding that #455 will increase score. Moving to done!