{"id":"CVE-2026-44728","aliases":["GHSA-fv7c-fp4j-7gwp"],"url":"https://o3.security/vulnerability/CVE-2026-44728","summary":"Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs","details":"### Impact\n\nUsing Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code.\n\nKnown affected plugins are:\n- `@babel/plugin-transform-modules-systemjs`\n- `@babel/preset-env` when using the [`modules: \"systemjs\"` option](https://babel.dev/docs/babel-preset-env#modules), as it delegates to `@babel/plugin-transform-modules-systemjs`\n\nNo other plugins under the `@babel` namespace are impacted.\n\n**Users that only compile trusted code are not impacted.**\n\n### Patches\n\nThe vulnerability has been fixed in `@babel/plugin-transform-modules-systemjs@7.29.4`.\n\nBabel also released `@babel/preset-env@7.29.5`, updating its `@babel/plugin-transform-modules-systemjs` dependency, to simplify forcing the update if you are using `@babel/preset-env` directly.\n\n### Workarounds\n\n- Pin `@babel/parser` to v7.11.5. The downgrade will completely disable string module name parsing, but it would also disable other new language features and the build pipeline may fail as a result. Only do so if you are working on a legacy codebase and can not upgrade `@babel/plugin-transform-modules-systemjs` to v7.29.4.\n- Do not use the `modules: \"systemjs\"` option, migrate the codebase to native ES Modules or any other module formats.\n\n### Credits\nBabel thanks Daniel Cervera for reporting the vulnerability.","published":"2026-05-26T17:48:57.603Z","modified":"2026-08-12T03:51:29.341315449Z","cvss":{"score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},"epss":{"score":0.00125,"percentile":0.02605,"asOf":"2026-08-13"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@babel/plugin-transform-modules-systemjs","fixedVersion":"7.29.4"},{"ecosystem":"npm","name":"@babel/plugin-transform-modules-systemjs","fixedVersion":"8.0.0-alpha.13"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44728.json"},{"type":"ADVISORY","url":"https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44728"},{"type":"PACKAGE","url":"https://github.com/babel/babel"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:29.341315449Z"}}