Vulnerability in the @babel/helpers dependency of ReactNative LLaMA App
Open
Nobody has claimed this yet.
module: reactnative
- Dominant language
- Python
- Stars
- 5k
- Forks
- 1.2k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 581
Description
🐛 Describe the bug
Package Dependency
- Repository: pytorch/executorch
- Manifest file: examples/demo-apps/react-native/rnllama/yarn.lock
- Package name: @babel/helpers
- Affected versions: < 7.26.10
- Fixed in version: 7.26.10
- Severity: MODERATE
Identifiers
- GHSA-968p-4wvh-cqc8
- CVE-2025-27789
References
- https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8
- https://github.com/babel/babel/pull/17173
- https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4
- https://github.com/advisories/GHSA-968p-4wvh-cqc8
Versions
.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with examples/demo-apps/react-native/rnllama/yarn.lock and inspect the recorded @babel/helpers version. Update the dependency resolution to version 7.26.10 or later, then verify the lockfile no longer uses an affected version and that the React Native app dependency installation remains consistent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- babel, javascript, react-native
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 50/100