CVE-2026-44728: Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs
Analyzed
AliasesUBUNTU-CVE-2026-44728DEBIAN-CVE-2026-44728CGA-24mg-phw8-c452CGA-2v5g-hhgv-rr76CGA-2x22-65mf-7x2qCGA-36rx-5fcx-554rCGA-4f52-6xmq-g2jfCGA-562f-r9m6-xw5vCGA-56vw-96r4-2m98CGA-5hq2-jhvf-h87qCGA-6gg6-4xv5-5663CGA-6p2r-6rx4-p9mxCGA-8wv4-j2mr-25q7CGA-992m-p8mg-222xCGA-9xpw-9m2c-2825CGA-9xvv-66jg-qjxpCGA-c59h-mxv4-q4chCGA-g8rc-778p-jmhfCGA-m9f5-66rg-5hwwCGA-qwcx-xp48-9fmmCGA-rx42-rvqp-v5vmCGA-vw6v-9gwx-84q6CGA-wc8p-5ffw-728xCGA-xc6q-76vc-xhjqCGA-xm5x-mhmg-5rpvGHSA-fv7c-fp4j-7gwpCGA-2c92-ww3g-cmmfCGA-2g3f-3332-xc2vCGA-2qwp-232g-j5frCGA-2r44-v73w-jmhvCGA-2r98-4w3x-ffcpCGA-3479-3ghg-w7xhCGA-3588-5254-4rh4CGA-36v3-6p83-63grCGA-38mj-v5ff-328jCGA-3cqx-6774-rc82CGA-3cv2-mq56-977qCGA-3hfh-mx7c-hc45CGA-3qq7-hgf8-6g4vCGA-3rf5-898w-j3pcCGA-42hq-9f75-fgw5CGA-43r5-923f-qf85CGA-4823-2c5m-rhjvCGA-4m83-7gvg-54hfCGA-4vhv-j329-mhv3CGA-4vq8-pm6r-9hhxCGA-575w-jghg-7j28CGA-5gp9-c3m5-95hrCGA-5gpj-qcx7-mg8rCGA-5gvw-m8c8-ww95CGA-5jcp-6vm7-7vhgCGA-5mrj-v8mx-jq67CGA-5vj6-mg2r-8978CGA-5w36-x9vm-5g53CGA-5xq7-5hvp-jxrqCGA-62cc-h6v9-2wfvCGA-6655-hqqj-3pwwCGA-6fpx-j8f6-4hfpCGA-6ggx-7v43-77qfCGA-6j88-749c-vwcjCGA-6jc6-gfjc-3gg2CGA-6jfq-cvfm-5jxgCGA-749h-gjrx-w4p4CGA-7gff-pfh3-w2xmCGA-7gqh-69vc-hw5fCGA-7j57-v263-jxxcCGA-83rv-9cmx-m3g6CGA-873q-x2r4-ccrxCGA-87cj-gxpx-xfc7CGA-8hh4-5p9g-5535CGA-8pqx-8q4w-qh7fCGA-8qc6-fm7w-6m74CGA-8w66-mh5p-5qrxCGA-936h-5677-xrwcCGA-95wj-w7m2-m678CGA-9m25-m5xh-ffgvCGA-9qvp-jcj8-vjjqCGA-9r39-9qj3-vmxrCGA-9x6c-585w-px35CGA-c8g9-7q42-6v3vCGA-cm53-8cj3-3cjjCGA-cpjw-4w7r-222cCGA-cq2j-v868-9qh5CGA-fc3v-qh92-mcx8CGA-fcjc-h57w-2wm3CGA-ff2p-3c9q-3qw6CGA-fj7v-phmx-cfh8CGA-fj8c-263w-qgp3CGA-fqgj-7vgr-3vjcCGA-fw25-7m4f-3jgpCGA-g75x-xq54-9v6jCGA-g86f-55hh-3x37CGA-g8r2-752f-j882CGA-gf2v-3952-m4ffCGA-gg96-vgf9-pg23CGA-gx8j-h4jw-c5h8CGA-hq5p-gp5v-pgxcCGA-hv95-q8r3-8qv2CGA-j98h-9cwv-xwgpCGA-jg67-xpp5-rcrhCGA-jq3j-wrpf-g9jrCGA-m3v9-7g8f-mg39CGA-m8hx-3xwg-mp48CGA-mp4j-59pq-gpvvCGA-mpxr-9qc6-q5q2CGA-mrh8-m75x-8jxrCGA-p7c8-r5gv-f5q5CGA-ppvc-43rh-xpcxCGA-prcq-ww87-gvvgCGA-pv7q-vpgj-8w6pCGA-q3hv-gj8w-7796CGA-q43j-9mw8-wmh5CGA-q82g-p8mc-fr7qCGA-q878-cvj2-8jvcCGA-q8hj-7ghq-83v4CGA-q93v-gv6v-2897CGA-qh25-86wm-r97mCGA-qhcx-7h59-3hvmCGA-qj4m-926v-rrv8CGA-qmgf-j2pc-3p23CGA-qqq5-82hp-fx8fCGA-qw65-h3h7-4wv4CGA-qxm2-xfrw-6qf3CGA-r773-v943-wj49CGA-r82j-9c95-m96cCGA-rjjf-cmpq-h4c5CGA-v573-hr6q-fw7xCGA-vg4v-735f-j72fCGA-vp38-p59j-q64xCGA-vv6p-2h3f-hq8wCGA-vxv3-gf3h-j8q8CGA-w363-gx9p-86ccCGA-w5v6-7xqh-cf3xCGA-w745-77q2-94q3CGA-wxfg-8888-2pgjCGA-x2vg-vgp9-pgrjCGA-xr57-hg8f-whrgCGA-xvc4-mj58-2ffcCGA-xwmx-qmfp-73h3
Published 26-05-2026Last modified 28-05-2026
Vulnerability summary
CVE-2026-44728 is a high (CVSS 8.2) Improper Control of Generation of Code vulnerability in babel. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.2% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 8.2, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
8.2/10
010
High · v3.1 (CVE.org)EPSS score
0.13%
0%100%
Low · -0.05 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 26-05-2026PublishedVulnerability first disclosed.
- 28-05-2026Last modifiedVulnerability information updated.
Description
Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 8.2Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HSources7 sources · 7.8–8.2
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · WolfiEcosystem advisory · calculated8.2HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- OSV · NpmEcosystem advisory · calculated8.2HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.2HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
Decrease -0.05 pp
From 0.18% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-843Access of Resource Using Incompatible TypeThe product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Affected systems
Version check
Known conditions: local access, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard47 products
- airflow-2All versions (No fix recorded)
- airflow-core-2All versions (No fix recorded)
- arangodb-3.11< 3.11.14.5-r8
- arangodb-3.12< 3.12.9.4-r16
- argo-workflows-ui-3.6< 3.6.19-r6
Wolfi12 products
- argo-workflows-ui-3.7< 3.7.14-r1
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-goptuna-compatAll versions (No fix recorded)
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
@babel2 products
- plugin-transform-modules-systemjs≥ 7.12.0, < 7.29.4 | ≥ 8.0.0-alpha.0, < 8.0.0-alpha.13
- plugin-transform-modules-systemjs≥ 7.12.0, < 7.29.4 | ≥ 8.0.0-alpha.0, < 8.0.0-alpha.13
Babel1 product
- babel≥ 8.0.0-alpha.0, < 8.0.0-alpha.13 | ≥ 7.12.0, < 7.29.4 | 8.0.0:alpha0 | 8.0.0:alpha1 | 8.0.0:alpha10 | 8.0.0:alpha11 | 8.0.0:alpha12 | 8.0.0:alpha2 | 8.0.0:alpha3 | 8.0.0:alpha4 | 8.0.0:alpha5 | 8.0.0:alpha6 | 8.0.0:alpha7 | 8.0.0:alpha8 | 8.0.0:alpha9
Debian1 product
- node-babel7All versions (No fix recorded) | < 8.0.4+ds1+~cs177.303.116-2
Ubuntu1 product
- node-babel7All versions (No fix recorded)
6 vendors · 64 products
References
7 links- github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwpX Refsource CONFIRMREPORTAdvisoryWEBMitigationVendor Advisory
- github.com/babel/babelPACKAGE