CVE-2026-44728
Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs
HIGH 8.2
En bref
- Source
- NVD
- EPSS
- EPSS 0.13 % · centile 2 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Analyzed
Description
Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.
Faiblesses (CWE)
- CWE-94 — Injection de code
- CWE-843 — Confusion de type (accès à une ressource via un type incompatible)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H | GitHub_M |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-fv7c-fp4j-7gwp — @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
Références européennes
- ENISA EUVD · EUVD-2026-31946
- GCVE · GCVE-0-2026-44728
Avis du CERT-FR
- CERTFR-2026-AVI-1094 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:babel:babel:*:*:*:*:*:*:*:*≥ 7.12.0 < 7.29.4cpe:2.3:a:babel:babel:8.0.0:alpha0:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha1:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha10:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha11:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha12:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha2:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha3:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha4:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha5:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha6:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha7:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha8:*:*:*:*:*:*cpe:2.3:a:babel:babel:8.0.0:alpha9:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| babel · babel | affected >= 7.12.0, < 7.29.4 ; affected >= 8.0.0-alpha.0, < 8.0.0-alpha.13 |
| @babel · plugin-transform-modules-systemjs | affected >= 7.12.0, < 7.29.4 ; affected >= 8.0.0-alpha.0, < 8.0.0-alpha.13 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |