Vulnerability-Lookup

CVE-2025-27789 (GCVE-0-2025-27789)

Vulnerability from cvelistv5 – Published: 2025-03-11 19:09 – Updated: 2025-03-11 19:53

Title

Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups

Summary

Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/babel/babel/security/advisorie…	x_refsource_CONFIRM
https://github.com/babel/babel/pull/17173	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
babel	babel	Affected: < 7.26.10 Affected: >= 8.0.0-alpha.0, < 8.0.0-alpha.17

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27789",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-11T19:53:22.902147Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-11T19:53:42.811Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "babel",
          "vendor": "babel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.26.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0-alpha.0, \u003c 8.0.0-alpha.17"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It\u0027s likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-11T19:09:28.146Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8"
        },
        {
          "name": "https://github.com/babel/babel/pull/17173",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/babel/babel/pull/17173"
        }
      ],
      "source": {
        "advisory": "GHSA-968p-4wvh-cqc8",
        "discovery": "UNKNOWN"
      },
      "title": "Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-27789",
    "datePublished": "2025-03-11T19:09:28.146Z",
    "dateReserved": "2025-03-06T18:06:54.462Z",
    "dateUpdated": "2025-03-11T19:53:42.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-27789",
      "date": "2026-06-05",
      "epss": "0.0006",
      "percentile": "0.19054"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-27789\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-03-11T20:15:18.330\",\"lastModified\":\"2025-03-11T20:15:18.330\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It\u0027s likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.\"},{\"lang\":\"es\",\"value\":\"Babel es un compilador para escribir JavaScript de nueva generaci\u00f3n. Al usar versiones de Babel anteriores a la 7.26.10 y 8.0.0-alpha.17 para compilar grupos de captura con nombre de expresiones regulares, Babel generar\u00e1 un polyfill para el m\u00e9todo `.replace` con complejidad cuadr\u00e1tica en algunas cadenas de patrones de reemplazo espec\u00edficas (es decir, el segundo argumento pasado a `.replace`). El c\u00f3digo generado es vulnerable si se cumplen todas las siguientes condiciones: usar Babel para compilar grupos de captura con nombre de expresiones regulares, usar el m\u00e9todo `.replace` en una expresi\u00f3n regular que contenga grupos de captura con nombre y usar cadenas no confiables como segundo argumento de `.replace`. Este problema se ha corregido en `@babel/helpers` y `@babel/runtime` 7.26.10 y 8.0.0-alpha.17. Es probable que los usuarios individuales no dependan directamente de `@babel/helpers`, sino de `@babel/core` (que a su vez depende de `@babel/helpers`). No es necesario actualizar a `@babel/core` 7.26.10, pero garantiza el uso de una versi\u00f3n suficientemente nueva de `@babel/helpers`. Tenga en cuenta que actualizar las dependencias de Babel no es suficiente; tambi\u00e9n ser\u00e1 necesario recompilar el c\u00f3digo. No se conocen workarounds.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1333\"}]}],\"references\":[{\"url\":\"https://github.com/babel/babel/pull/17173\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-27789\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-11T19:53:22.902147Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-11T19:53:37.035Z\"}}], \"cna\": {\"title\": \"Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups\", \"source\": {\"advisory\": \"GHSA-968p-4wvh-cqc8\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"babel\", \"product\": \"babel\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 7.26.10\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.0-alpha.0, \u003c 8.0.0-alpha.17\"}]}], \"references\": [{\"url\": \"https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8\", \"name\": \"https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/babel/babel/pull/17173\", \"name\": \"https://github.com/babel/babel/pull/17173\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It\u0027s likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1333\", \"description\": \"CWE-1333: Inefficient Regular Expression Complexity\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-03-11T19:09:28.146Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-27789\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-11T19:53:42.811Z\", \"dateReserved\": \"2025-03-06T18:06:54.462Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-03-11T19:09:28.146Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

WID-SEC-W-2025-1617

Vulnerability from csaf_certbund - Published: 2025-07-21 22:00 - Updated: 2025-07-21 22:00

Summary

IBM Cognos Analytics: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: IBM Cognos Analytics ist eine Business-Intelligence-Lösung, z. B. für Reporting-Zwecke.

Angriff: Ein Angreifer kann mehrere Schwachstellen in IBM Cognos Analytics ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.

Betroffene Betriebssysteme: - iPhoneOS

CVE-2025-36062

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
IBM Cognos Analytics Mobile (iOS) <1.1.23 IBM / Cognos Analytics		Mobile (iOS) <1.1.23

CVE-2025-36106

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
IBM Cognos Analytics Mobile (iOS) <1.1.23 IBM / Cognos Analytics		Mobile (iOS) <1.1.23

CVE-2025-36107

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
IBM Cognos Analytics Mobile (iOS) <1.1.23 IBM / Cognos Analytics		Mobile (iOS) <1.1.23

CVE-2025-27789

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
IBM Cognos Analytics Mobile (iOS) <1.1.23 IBM / Cognos Analytics		Mobile (iOS) <1.1.23

CVE-2025-36057

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
IBM Cognos Analytics Mobile (iOS) <1.1.23 IBM / Cognos Analytics		Mobile (iOS) <1.1.23

References

3 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.ibm.com/support/pages/node/7239635	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "IBM Cognos Analytics ist eine Business-Intelligence-L\u00f6sung, z. B. f\u00fcr Reporting-Zwecke.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in IBM Cognos Analytics ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuf\u00fchren, und um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- iPhoneOS",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-1617 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1617.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-1617 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1617"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2025-07-21",
        "url": "https://www.ibm.com/support/pages/node/7239635"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM Cognos Analytics: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-07-21T22:00:00.000+00:00",
      "generator": {
        "date": "2025-07-22T09:56:52.549+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.4.0"
        }
      },
      "id": "WID-SEC-W-2025-1617",
      "initial_release_date": "2025-07-21T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-07-21T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Mobile (iOS) \u003c1.1.23",
                "product": {
                  "name": "IBM Cognos Analytics Mobile (iOS) \u003c1.1.23",
                  "product_id": "T045560"
                }
              },
              {
                "category": "product_version",
                "name": "Mobile (iOS) 1.1.23",
                "product": {
                  "name": "IBM Cognos Analytics Mobile (iOS) 1.1.23",
                  "product_id": "T045560-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:cognos_analytics:mobile_%2528ios%2529__1.1.23"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Cognos Analytics"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-36062",
      "product_status": {
        "known_affected": [
          "T045560"
        ]
      },
      "release_date": "2025-07-21T22:00:00.000+00:00",
      "title": "CVE-2025-36062"
    },
    {
      "cve": "CVE-2025-36106",
      "product_status": {
        "known_affected": [
          "T045560"
        ]
      },
      "release_date": "2025-07-21T22:00:00.000+00:00",
      "title": "CVE-2025-36106"
    },
    {
      "cve": "CVE-2025-36107",
      "product_status": {
        "known_affected": [
          "T045560"
        ]
      },
      "release_date": "2025-07-21T22:00:00.000+00:00",
      "title": "CVE-2025-36107"
    },
    {
      "cve": "CVE-2025-27789",
      "product_status": {
        "known_affected": [
          "T045560"
        ]
      },
      "release_date": "2025-07-21T22:00:00.000+00:00",
      "title": "CVE-2025-27789"
    },
    {
      "cve": "CVE-2025-36057",
      "product_status": {
        "known_affected": [
          "T045560"
        ]
      },
      "release_date": "2025-07-21T22:00:00.000+00:00",
      "title": "CVE-2025-36057"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-27789 (GCVE-0-2025-27789)

WID-SEC-W-2025-1617

Tags

Sightings

Nomenclature