CVE-2026-44728CWE-843CWE-94

Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs

High · published May 26, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00180 · 7.1th percentile
Weaknesses
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-05-26T17:48Z
EPSS history
Timeline
  • 26 MAY 17:48Z
    Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs
    cvelistv5