cve.bz

CVE-2026-44728

7.8 highEPSS 0.1%

High (7.8) in babel babel. EPSS 0.1% chance of exploitation in the next 30 days. Fixed in @babel/plugin-transform-modules-systemjs 7.29.4, 8.0.0-alpha.13.

Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.

Severity

CVSS 3.1

7.8 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-31)
CWEs
CWE-94, CWE-843
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-fv7c-fp4j-7gwpnpm@babel/plugin-transform-modules-systemjs>=7.12.0 <7.29.47.29.4
GHSA-fv7c-fp4j-7gwpnpm@babel/plugin-transform-modules-systemjs>=8.0.0-alpha.0 <8.0.0-alpha.138.0.0-alpha.13

References

Check your stackJSON