Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-44728

Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

babel babel

  • >= 7.12.0, < 7.29.4affected
  • >= 8.0.0-alpha.0, < 8.0.0-alpha.13affected

@babel plugin-transform-modules-systemjs

  • >= 7.12.0, < 7.29.4affected
  • >= 8.0.0-alpha.0, < 8.0.0-alpha.13affected

References