Vulnerability in the @babel/runtime dependency of React Native LLaMA App
Open
Nobody has claimed this yet.
module: reactnative
- Dominant language
- Python
- Stars
- 5k
- Forks
- 1.2k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 581
Description
🐛 Describe the bug
Package Dependency
- Repository: pytorch/executorch
- Manifest file: examples/demo-apps/react-native/rnllama/yarn.lock
- Package name: @babel/runtime
- Affected versions: < 7.26.10
- Fixed in version: 7.26.10
- Severity: MODERATE
Identifiers
- GHSA-968p-4wvh-cqc8
- CVE-2025-27789
References
- https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8
- https://github.com/babel/babel/pull/17173
- https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4
- https://github.com/advisories/GHSA-968p-4wvh-cqc8
Versions
.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with examples/demo-apps/react-native/rnllama/yarn.lock and inspect the @babel/runtime entry. Update the resolved dependency to version 7.26.10 or newer, then verify the lockfile no longer reports GHSA-968p-4wvh-cqc8 or CVE-2025-27789.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- babel, javascript, react-native
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100