Priority from VULN: Medium
This is a copy of the linked VULN ticket issue. You only need to update this ticket and the VULN ticket will be synced accordingly.

---

Vulnerability Details

The following vulnerabilities were found in the third party component pkg:npm/%40babel/runtime-corejs3@7.22.6 used in the repo: https://github.com/mongodb-js/mongosh:

You are responsible for fixing it by and ensuring the fix is released, if required, by the relevant Due Date.

• A new release is required if the finding is on a stable branch that customers may be using. Stable branches refer to any branch excluding main or master, for products that do not trigger releases directly from main or master branches.

Affected Platforms: _linux-ppc64le, _linux-x64, _linux-x64-openssl3, _darwin-x64, _win32, _darwin-arm64, _linux-arm64-openssl3, _linux-arm64-openssl11, _linux-arm64, _linux-s390x, _linux-x64-openssl11

How do I fix this?
You need to update the package to a version that does not contain the vulnerability. Please review the references section for options. If you are still unable to find a fixed version or need additional assistance, please reach out in the #secure-sdlc-program channel.

References:

• https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8
• https://github.com/babel/babel/pull/17173
• https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4
• https://github.com/babel/babel

Tool Description: ### Impact

When using Babel to compile [regular expression named capturing groups](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Named_capturing_group), Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`).

Your generated code is vulnerable if all the following conditions are true:

• You use Babel to compile [regular expression named capturing groups](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Named_capturing_group) or
• You use the `.replace` method on a regular expression that contains named capturing groups
• *Your code uses untrusted strings as the second argument of `.replace`*

If you are using `@babel/preset-env` with the [`targets`](https://babeljs.io/docs/options#targets) option, the transform that injects the vulnerable code is automatically enabled if:

• you use [_duplicated_ named capturing groups](https://github.com/tc39/proposal-duplicate-named-capturing-groups), and target any browser older than Chrome/Edge 126, Opera 112, Firefox 129, Safari 17.4, or Node.js 23
• you use any [named capturing groups](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Named_capturing_group), and target any browser older than Chrome 64, Opera 71, Edge 79, Firefox 78, Safari 11.1, or Node.js 10

You can verify what transforms `@babel/preset-env` is using by enabling the [`debug` option](https://babeljs.io/docs/babel-preset-env#debug).

1. 1. 1. Patches

This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17, please upgrade. It's likely that you do not directly depend on `@babel/helpers`, and instead you depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees that you are on a new enough `@babel/helpers` version.

Please note that just updating your Babel dependencies is not enough: you will also need to re-compile your code.

1. 1. 1. Workarounds

If you are passing user-provided strings as the second argument of `.replace` on regular expressions that contain named capturing groups, validate the input and make sure it does not contain the substring `$<` if it's then not followed by `>` (possibly with other characters in between).

1. 1. 1. References

This vulnerability was reported and fixed in https://github.com/babel/babel/pull/17173.

🔥 Please see go/vuln-flow for detailed guidance.