CVE-2026-44728
Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs
HIGH 8.2
At a glance
- Source
- NVD
- EPSS
- EPSS 0.13 % · percentile 2 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Analyzed
Description
Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H | GitHub_M |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-fv7c-fp4j-7gwp — @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
European references
- ENISA EUVD · EUVD-2026-31946
- GCVE · GCVE-0-2026-44728
CERT-FR advisories
- CERTFR-2026-AVI-1094 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:babel:babel:*:*:*:*:*:*:*:*≥ 7.12.0 < 7.29.4cpe:2.3:a:babel:babel:8.0.0:alpha0:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha1:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha10:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha11:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha12:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha2:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha3:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha4:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha5:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha6:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha7:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha8:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha9:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| babel · babel | affected >= 7.12.0, < 7.29.4 ; affected >= 8.0.0-alpha.0, < 8.0.0-alpha.13 |
| @babel · plugin-transform-modules-systemjs | affected >= 7.12.0, < 7.29.4 ; affected >= 8.0.0-alpha.0, < 8.0.0-alpha.13 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |