p PatchFirst

CVE-2026-44728

CVE-2026-44728 · Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.

CVSS 8.2 · High · EPSS 0.1% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • babel

    Versions
    • >= 7.12.0, < 7.29.4: Affected
    • >= 8.0.0-alpha.0, < 8.0.0-alpha.13: Affected

    No fix published

  • plugin-transform-modules-systemjs

    Versions
    • >= 7.12.0, < 7.29.4: Affected
    • >= 8.0.0-alpha.0, < 8.0.0-alpha.13: Affected

    No fix published

  • node-babel7 Debian:12

    Versions
    • 7.20.15+ds1+~cs214.269.168-10
    • 7.20.15+ds1+~cs214.269.168-11
    • 7.20.15+ds1+~cs214.269.168-12
    • 7.20.15+ds1+~cs214.269.168-13
    • 7.20.15+ds1+~cs214.269.168-14
    • 7.20.15+ds1+~cs214.269.168-15
    • 7.20.15+ds1+~cs214.269.168-16
    • 7.20.15+ds1+~cs214.269.168-17
    • 7.20.15+ds1+~cs214.269.168-18
    • 7.20.15+ds1+~cs214.269.168-3
    • 7.20.15+ds1+~cs214.269.168-3+deb12u1
    • 7.20.15+ds1+~cs214.269.168-3+deb12u2
    • 7.20.15+ds1+~cs214.269.168-4
    • 7.20.15+ds1+~cs214.269.168-5
    • 7.20.15+ds1+~cs214.269.168-6
    • 7.20.15+ds1+~cs214.269.168-7
    • 7.20.15+ds1+~cs214.269.168-8
    • 7.20.15+ds1+~cs214.269.168-9
    • 8.0.4+ds1+~cs177.303.116-1
    • 8.0.4+ds1+~cs177.303.116-2
    • 8.0.4+ds1+~cs177.303.116-3
    • 8.0.6+ds1+~cs177.303.116-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-babel7 Debian:13

    Versions
    • 7.20.15+ds1+~cs214.269.168-10
    • 7.20.15+ds1+~cs214.269.168-11
    • 7.20.15+ds1+~cs214.269.168-12
    • 7.20.15+ds1+~cs214.269.168-13
    • 7.20.15+ds1+~cs214.269.168-14
    • 7.20.15+ds1+~cs214.269.168-15
    • 7.20.15+ds1+~cs214.269.168-16
    • 7.20.15+ds1+~cs214.269.168-17
    • 7.20.15+ds1+~cs214.269.168-18
    • 7.20.15+ds1+~cs214.269.168-8
    • 7.20.15+ds1+~cs214.269.168-9
    • 8.0.4+ds1+~cs177.303.116-1
    • 8.0.4+ds1+~cs177.303.116-2
    • 8.0.4+ds1+~cs177.303.116-3
    • 8.0.6+ds1+~cs177.303.116-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-babel7 Debian:14

    Versions
    • 7.20.15+ds1+~cs214.269.168-10
    • 7.20.15+ds1+~cs214.269.168-11
    • 7.20.15+ds1+~cs214.269.168-12
    • 7.20.15+ds1+~cs214.269.168-13
    • 7.20.15+ds1+~cs214.269.168-14
    • 7.20.15+ds1+~cs214.269.168-15
    • 7.20.15+ds1+~cs214.269.168-16
    • 7.20.15+ds1+~cs214.269.168-17
    • 7.20.15+ds1+~cs214.269.168-18
    • 7.20.15+ds1+~cs214.269.168-8
    • 7.20.15+ds1+~cs214.269.168-9
    • 8.0.4+ds1+~cs177.303.116-1
    Affected ranges
    • ECOSYSTEM: < 8.0.4+ds1+~cs177.303.116-2

    Update to 8.0.4+ds1+~cs177.303.116-2

  • @babel/plugin-transform-modules-systemjs npm

    Affected ranges
    • SEMVER: ≥ 7.12.0, < 7.29.4

    Update to 7.29.4

  • @babel/plugin-transform-modules-systemjs npm

    Affected ranges
    • SEMVER: ≥ 8.0.0-alpha.0, < 8.0.0-alpha.13

    Update to 8.0.0-alpha.13

  • node-babel7 Ubuntu:22.04:LTS

    Versions
    • 7.12.12+~cs150.141.84-6
    • 7.12.12+~cs150.141.84-7
    • 7.12.12+~cs150.141.84-8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-babel7 Ubuntu:24.04:LTS

    Versions
    • 7.20.15+ds1+~cs214.269.168-4
    • 7.20.15+ds1+~cs214.269.168-5
    • 7.20.15+ds1+~cs214.269.168-6
    • 7.20.15+ds1+~cs214.269.168-6build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-babel7 Ubuntu:25.10

    Versions
    • 7.20.15+ds1+~cs214.269.168-8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-babel7 Ubuntu:26.10

    Versions
    • 7.20.15+ds1+~cs214.269.168-16
    • 7.20.15+ds1+~cs214.269.168-17build1
    • 7.20.15+ds1+~cs214.269.168-17build2
    • 7.20.15+ds1+~cs214.269.168-18
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-babel7 Ubuntu:26.04:LTS

    Versions
    • 7.20.15+ds1+~cs214.269.168-8
    • 7.20.15+ds1+~cs214.269.168-9
    • 7.20.15+ds1+~cs214.269.168-11build1
    • 7.20.15+ds1+~cs214.269.168-14
    • 7.20.15+ds1+~cs214.269.168-16
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →