Vulnerability-Lookup

CVE-2026-44728 (GCVE-0-2026-44728)

Vulnerability from cvelistv5 – Published: 2026-05-26 17:48 – Updated: 2026-05-28 03:55

Title

Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs

Summary

Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/babel/babel/security/advisorie…	x_refsource_CONFIRM

Impacted products

2 products

Vendor	Product	Version
babel	babel	Affected: >= 7.12.0, < 7.29.4 Affected: >= 8.0.0-alpha.0, < 8.0.0-alpha.13
@babel	plugin-transform-modules-systemjs	Affected: >= 7.12.0, < 7.29.4 Affected: >= 8.0.0-alpha.0, < 8.0.0-alpha.13

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44728",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T03:55:38.825Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "babel",
          "vendor": "babel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.12.0, \u003c 7.29.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0-alpha.0, \u003c 8.0.0-alpha.13"
            }
          ]
        },
        {
          "product": "plugin-transform-modules-systemjs",
          "vendor": "@babel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.12.0, \u003c 7.29.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0-alpha.0, \u003c 8.0.0-alpha.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T17:48:57.603Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp"
        }
      ],
      "source": {
        "advisory": "GHSA-fv7c-fp4j-7gwp",
        "discovery": "UNKNOWN"
      },
      "title": "Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44728",
    "datePublished": "2026-05-26T17:48:57.603Z",
    "dateReserved": "2026-05-07T18:04:17.309Z",
    "dateUpdated": "2026-05-28T03:55:38.825Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-44728",
      "date": "2026-07-26",
      "epss": "0.00125",
      "percentile": "0.02603"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-44728\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-26T18:16:50.880\",\"lastModified\":\"2026-07-24T11:10:00.170\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.\"},{\"lang\":\"es\",\"value\":\"Babel es un compilador para escribir JavaScript de pr\u00f3xima generaci\u00f3n. Desde la versi\u00f3n 7.12.0 hasta antes de la 7.29.4 y la 8.0.0-alpha.13, usar Babel para compilar c\u00f3digo que fue espec\u00edficamente dise\u00f1ado por un atacante puede hacer que Babel genere c\u00f3digo de salida que ejecuta c\u00f3digo arbitrario. Esta vulnerabilidad est\u00e1 corregida en la 7.29.4 y la 8.0.0-alpha.13.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"babel\",\"product\":\"babel\",\"versions\":[{\"version\":\"\u003e= 7.12.0, \u003c 7.29.4\",\"status\":\"affected\"},{\"version\":\"\u003e= 8.0.0-alpha.0, \u003c 8.0.0-alpha.13\",\"status\":\"affected\"}]},{\"vendor\":\"@babel\",\"product\":\"plugin-transform-modules-systemjs\",\"versions\":[{\"version\":\"\u003e= 7.12.0, \u003c 7.29.4\",\"status\":\"affected\"},{\"version\":\"\u003e= 8.0.0-alpha.0, \u003c 8.0.0-alpha.13\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.5,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-27T00:00:00+00:00\",\"id\":\"CVE-2026-44728\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"},{\"lang\":\"en\",\"value\":\"CWE-843\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:babel:babel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.12.0\",\"versionEndExcluding\":\"7.29.4\",\"matchCriteriaId\":\"284B552B-0419-42FB-A5B4-2C214887D1E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:babel:babel:8.0.0:alpha0:*:*:*:*:*:*\",\"matchCriteriaId\":\"35F6AF6B-8CB6-40BB-B0AE-32E89718ED8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:babel:babel:8.0.0:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DAFA4C96-CD2A-47A5-BA4E-134BA1D366B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:babel:babel:8.0.0:alpha10:*:*:*:*:*:*\",\"matchCriteriaId\":\"BAC310EC-C0CF-4D27-BA54-20B3207B4118\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:babel:babel:8.0.0:alpha11:*:*:*:*:*:*\",\"matchCriteriaId\":\"80E37BB6-34C2-437B-A9DC-018B23F5E7BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:babel:babel:8.0.0:alpha12:*:*:*:*:*:*\",\"matchCriteriaId\":\"B74C4261-EB8F-448D-AF41-CB82246C3EB4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:babel:babel:8.0.0:alpha2:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD426CF6-E4B7-4F65-9968-A485F745E377\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:babel:babel:8.0.0:alpha3:*:*:*:*:*:*\",\"matchCriteriaId\":\"92CE9983-D67E-4DE6-B9EE-CCE55DF615E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:babel:babel:8.0.0:alpha4:*:*:*:*:*:*\",\"matchCriteriaId\":\"66E5DE6B-CD6D-4687-AB1C-90B294DE8DCC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:babel:babel:8.0.0:alpha5:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E3BD45A-177D-4006-8820-EEABE6EF03FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:babel:babel:8.0.0:alpha6:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9323EF4-77AA-410A-A2F7-D905C6175A64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:babel:babel:8.0.0:alpha7:*:*:*:*:*:*\",\"matchCriteriaId\":\"67E62B17-72F2-464F-AB14-E7A9F744AC01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:babel:babel:8.0.0:alpha8:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDC6F0F5-3141-41CD-B8D0-13AE9FF4FFEC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:babel:babel:8.0.0:alpha9:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC459C4A-04F3-4521-A7EA-A03A118AA4F0\"}]}]}],\"references\":[{\"url\":\"https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-05-28T08:12:43+00:00",
      "cve": "CVE-2026-44728",
      "id": "CVE-2026-44728",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44728.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-07T02:21:25Z",
      "cve": "CVE-2026-44728",
      "id": "CVE-2026-44728",
      "initial_release_date": "2026-05-28T03:57:49Z",
      "product_status:known_affected": "75",
      "product_status:known_not_affected": "112",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-44728",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-44728.json",
      "version": "5"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs\", \"source\": {\"advisory\": \"GHSA-fv7c-fp4j-7gwp\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"babel\", \"product\": \"babel\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 7.12.0, \u003c 7.29.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.0-alpha.0, \u003c 8.0.0-alpha.13\"}]}, {\"vendor\": \"@babel\", \"product\": \"plugin-transform-modules-systemjs\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 7.12.0, \u003c 7.29.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.0-alpha.0, \u003c 8.0.0-alpha.13\"}]}], \"references\": [{\"url\": \"https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp\", \"name\": \"https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-843\", \"description\": \"CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-26T17:48:57.603Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-44728\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-27T13:13:27.431537Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-05-27T13:13:42.205Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-44728\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-26T17:48:57.603Z\", \"dateReserved\": \"2026-05-07T18:04:17.309Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-26T17:48:57.603Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-44728

Vulnerability from fkie_nvd - Published: 2026-05-26 18:16 - Updated: 2026-06-17 10:51

Severity

8.2 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp	Mitigation, Vendor Advisory

Impacted products

Vendor	Product	Version
babel	babel	*
babel	babel	8.0.0
babel	babel	8.0.0
babel	babel	8.0.0
babel	babel	8.0.0
babel	babel	8.0.0
babel	babel	8.0.0
babel	babel	8.0.0
babel	babel	8.0.0
babel	babel	8.0.0
babel	babel	8.0.0
babel	babel	8.0.0
babel	babel	8.0.0
babel	babel	8.0.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "babel",
          "vendor": "babel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.12.0, \u003c 7.29.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0-alpha.0, \u003c 8.0.0-alpha.13"
            }
          ]
        },
        {
          "product": "plugin-transform-modules-systemjs",
          "vendor": "@babel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.12.0, \u003c 7.29.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0-alpha.0, \u003c 8.0.0-alpha.13"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:babel:babel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "284B552B-0419-42FB-A5B4-2C214887D1E9",
              "versionEndExcluding": "7.29.4",
              "versionStartIncluding": "7.12.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha0:*:*:*:*:*:*",
              "matchCriteriaId": "35F6AF6B-8CB6-40BB-B0AE-32E89718ED8C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha1:*:*:*:*:*:*",
              "matchCriteriaId": "DAFA4C96-CD2A-47A5-BA4E-134BA1D366B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha10:*:*:*:*:*:*",
              "matchCriteriaId": "BAC310EC-C0CF-4D27-BA54-20B3207B4118",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha11:*:*:*:*:*:*",
              "matchCriteriaId": "80E37BB6-34C2-437B-A9DC-018B23F5E7BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha12:*:*:*:*:*:*",
              "matchCriteriaId": "B74C4261-EB8F-448D-AF41-CB82246C3EB4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha2:*:*:*:*:*:*",
              "matchCriteriaId": "BD426CF6-E4B7-4F65-9968-A485F745E377",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha3:*:*:*:*:*:*",
              "matchCriteriaId": "92CE9983-D67E-4DE6-B9EE-CCE55DF615E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha4:*:*:*:*:*:*",
              "matchCriteriaId": "66E5DE6B-CD6D-4687-AB1C-90B294DE8DCC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha5:*:*:*:*:*:*",
              "matchCriteriaId": "5E3BD45A-177D-4006-8820-EEABE6EF03FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha6:*:*:*:*:*:*",
              "matchCriteriaId": "D9323EF4-77AA-410A-A2F7-D905C6175A64",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha7:*:*:*:*:*:*",
              "matchCriteriaId": "67E62B17-72F2-464F-AB14-E7A9F744AC01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha8:*:*:*:*:*:*",
              "matchCriteriaId": "BDC6F0F5-3141-41CD-B8D0-13AE9FF4FFEC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha9:*:*:*:*:*:*",
              "matchCriteriaId": "FC459C4A-04F3-4521-A7EA-A03A118AA4F0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13."
    }
  ],
  "id": "CVE-2026-44728",
  "lastModified": "2026-06-17T10:51:16.920",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44728",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-27T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-26T18:16:50.880",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-843"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-FV7C-FP4J-7GWP

Vulnerability from github – Published: 2026-05-08 20:34 – Updated: 2026-06-08 23:28

Summary

@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

Details

Impact

Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code.

Known affected plugins are: - @babel/plugin-transform-modules-systemjs - @babel/preset-env when using the modules: "systemjs" option, as it delegates to @babel/plugin-transform-modules-systemjs

No other plugins under the @babel namespace are impacted.

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/plugin-transform-modules-systemjs@7.29.4.

Babel also released @babel/preset-env@7.29.5, updating its @babel/plugin-transform-modules-systemjs dependency, to simplify forcing the update if you are using @babel/preset-env directly.

Workarounds

Pin @babel/parser to v7.11.5. The downgrade will completely disable string module name parsing, but it would also disable other new language features and the build pipeline may fail as a result. Only do so if you are working on a legacy codebase and can not upgrade @babel/plugin-transform-modules-systemjs to v7.29.4.
Do not use the modules: "systemjs" option, migrate the codebase to native ES Modules or any other module formats.

Credits

Babel thanks Daniel Cervera for reporting the vulnerability.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.29.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@babel/plugin-transform-modules-systemjs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.12.0"
            },
            {
              "fixed": "7.29.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.0-alpha.12"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@babel/plugin-transform-modules-systemjs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0-alpha.0"
            },
            {
              "fixed": "8.0.0-alpha.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44728"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-843",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T20:34:07Z",
    "nvd_published_at": "2026-05-26T18:16:50Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nUsing Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code.\n\nKnown affected plugins are:\n- `@babel/plugin-transform-modules-systemjs`\n- `@babel/preset-env` when using the [`modules: \"systemjs\"` option](https://babel.dev/docs/babel-preset-env#modules), as it delegates to `@babel/plugin-transform-modules-systemjs`\n\nNo other plugins under the `@babel` namespace are impacted.\n\n**Users that only compile trusted code are not impacted.**\n\n### Patches\n\nThe vulnerability has been fixed in `@babel/plugin-transform-modules-systemjs@7.29.4`.\n\nBabel also released `@babel/preset-env@7.29.5`, updating its `@babel/plugin-transform-modules-systemjs` dependency, to simplify forcing the update if you are using `@babel/preset-env` directly.\n\n### Workarounds\n\n- Pin `@babel/parser` to v7.11.5. The downgrade will completely disable string module name parsing, but it would also disable other new language features and the build pipeline may fail as a result. Only do so if you are working on a legacy codebase and can not upgrade `@babel/plugin-transform-modules-systemjs` to v7.29.4.\n- Do not use the `modules: \"systemjs\"` option, migrate the codebase to native ES Modules or any other module formats.\n\n### Credits\nBabel thanks Daniel Cervera for reporting the vulnerability.",
  "id": "GHSA-fv7c-fp4j-7gwp",
  "modified": "2026-06-08T23:28:08Z",
  "published": "2026-05-08T20:34:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44728"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/babel/babel"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input"
}

ubuntu-cve-2026-44728

Vulnerability from osv_ubuntu

Published

2026-05-26 18:16

Modified

2026-06-11 13:05

Summary

Details

Severity

8.2 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-44728	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-44728	REPORT
	https://github.com/babel/babel/security/advisorie…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-babel7",
            "binary_version": "7.12.12+~cs150.141.84-8"
          },
          {
            "binary_name": "node-babel7-runtime",
            "binary_version": "7.12.12+~cs150.141.84-8"
          },
          {
            "binary_name": "node-babel7-standalone",
            "binary_version": "7.12.12+~cs150.141.84-8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "node-babel7",
        "purl": "pkg:deb/ubuntu/node-babel7@7.12.12+~cs150.141.84-8?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.12.12+~cs150.141.84-6",
        "7.12.12+~cs150.141.84-7",
        "7.12.12+~cs150.141.84-8"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-babel7",
            "binary_version": "7.20.15+ds1+~cs214.269.168-6build1"
          },
          {
            "binary_name": "node-babel7-debug",
            "binary_version": "7.20.15+ds1+~cs214.269.168-6build1"
          },
          {
            "binary_name": "node-babel7-runtime",
            "binary_version": "7.20.15+ds1+~cs214.269.168-6build1"
          },
          {
            "binary_name": "node-babel7-standalone",
            "binary_version": "7.20.15+ds1+~cs214.269.168-6build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "node-babel7",
        "purl": "pkg:deb/ubuntu/node-babel7@7.20.15+ds1+~cs214.269.168-6build1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.20.15+ds1+~cs214.269.168-4",
        "7.20.15+ds1+~cs214.269.168-5",
        "7.20.15+ds1+~cs214.269.168-6",
        "7.20.15+ds1+~cs214.269.168-6build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-babel7",
            "binary_version": "7.20.15+ds1+~cs214.269.168-8"
          },
          {
            "binary_name": "node-babel7-debug",
            "binary_version": "7.20.15+ds1+~cs214.269.168-8"
          },
          {
            "binary_name": "node-babel7-runtime",
            "binary_version": "7.20.15+ds1+~cs214.269.168-8"
          },
          {
            "binary_name": "node-babel7-standalone",
            "binary_version": "7.20.15+ds1+~cs214.269.168-8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "node-babel7",
        "purl": "pkg:deb/ubuntu/node-babel7@7.20.15+ds1+~cs214.269.168-8?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.20.15+ds1+~cs214.269.168-8"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-babel7",
            "binary_version": "7.20.15+ds1+~cs214.269.168-16"
          },
          {
            "binary_name": "node-babel7-debug",
            "binary_version": "7.20.15+ds1+~cs214.269.168-16"
          },
          {
            "binary_name": "node-babel7-runtime",
            "binary_version": "7.20.15+ds1+~cs214.269.168-16"
          },
          {
            "binary_name": "node-babel7-standalone",
            "binary_version": "7.20.15+ds1+~cs214.269.168-16"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "node-babel7",
        "purl": "pkg:deb/ubuntu/node-babel7@7.20.15+ds1+~cs214.269.168-16?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.20.15+ds1+~cs214.269.168-8",
        "7.20.15+ds1+~cs214.269.168-9",
        "7.20.15+ds1+~cs214.269.168-11build1",
        "7.20.15+ds1+~cs214.269.168-14",
        "7.20.15+ds1+~cs214.269.168-16"
      ]
    }
  ],
  "aliases": [],
  "details": "Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.",
  "id": "UBUNTU-CVE-2026-44728",
  "modified": "2026-06-11T13:05:27Z",
  "published": "2026-05-26T18:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-44728"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44728"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-44728"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-44728 (GCVE-0-2026-44728)

FKIE_CVE-2026-44728

GHSA-FV7C-FP4J-7GWP

Impact

Patches

Workarounds

Credits

ubuntu-cve-2026-44728

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature