Skip to main content

Babel EUVDEUVD-2026-31946

| CVE-2026-44728 HIGH
Code Injection (CWE-94)
2026-05-08 https://github.com/babel/babel GHSA-fv7c-fp4j-7gwp
RCE Code Injection
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
8.6 HIGH

Attacker needs no privileges, only to supply crafted source (AV:L, PR:N); a developer/CI must run the build (UI:R); injected code executes in a downstream runtime, so scope changes (S:C) with full CIA impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
8.2 HIGH
AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Re-analysis Queued
Jul 24, 2026 - 11:22 vuln.today
cvss_changed
CVSS changed
Jul 24, 2026 - 11:22 NVD
8.2 (HIGH) 7.8 (HIGH)
Source Code Evidence Fetched
Jul 23, 2026 - 22:45 vuln.today
Analysis Generated
Jul 23, 2026 - 22:45 vuln.today
CVE Published
May 08, 2026 - 20:34 nvd
HIGH 8.2

DescriptionNVD

Impact

Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code.

Known affected plugins are:

  • @babel/plugin-transform-modules-systemjs
  • @babel/preset-env when using the modules: "systemjs" option, as it delegates to @babel/plugin-transform-modules-systemjs

No other plugins under the @babel namespace are impacted.

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/plugin-transform-modules-systemjs@7.29.4.

Babel also released @babel/preset-env@7.29.5, updating its @babel/plugin-transform-modules-systemjs dependency, to simplify forcing the update if you are using @babel/preset-env directly.

Workarounds

  • Pin @babel/parser to v7.11.5. The downgrade will completely disable string module name parsing, but it would also disable other new language features and the build pipeline may fail as a result. Only do so if you are working on a legacy codebase and can not upgrade @babel/plugin-transform-modules-systemjs to v7.29.4.
  • Do not use the modules: "systemjs" option, migrate the codebase to native ES Modules or any other module formats.

Credits

Babel thanks Daniel Cervera for reporting the vulnerability.

AnalysisAI

Arbitrary code generation in Babel's @babel/plugin-transform-modules-systemjs (and @babel/preset-env when configured with modules: "systemjs") allows an attacker who can supply crafted source code to a build pipeline to make Babel emit output that executes arbitrary code at runtime. Affected are plugin versions >= 7.12.0 through 7.29.3 and 8.0.0-alpha.0 through 8.0.0-alpha.12; only setups that compile untrusted, attacker-supplied code with the SystemJS module transform are impacted. There is no public exploit identified at time of analysis and EPSS is very low (0.02%), but the CWE-94 code-injection nature and CVSS 8.2 warrant prompt patching of exposed build systems.

Technical ContextAI

Babel is a near-universal JavaScript/TypeScript compiler (transpiler) used in front-end and Node.js build pipelines. The flaw resides specifically in @babel/plugin-transform-modules-systemjs, the plugin that rewrites ES module syntax into the SystemJS (System.register) module format; @babel/preset-env is affected only transitively when its modules: "systemjs" option delegates to that plugin. The root cause is CWE-94 (Improper Control of Generation of Code / code injection): when the plugin processes specially crafted module input - the advisory ties the trigger to string module-name parsing introduced in newer @babel/parser versions - it produces transformed output that itself contains attacker-controlled executable statements rather than safely escaped identifiers. No other @babel namespace plugins are impacted per the vendor.

RemediationAI

Vendor-released patch: upgrade @babel/plugin-transform-modules-systemjs to 7.29.4 (or 8.0.0-alpha.13 on the 8.x pre-release line). If you consume the transform through @babel/preset-env, upgrade @babel/preset-env to 7.29.5, which bumps the plugin dependency to force the fix. If you cannot upgrade immediately, two workarounds apply: stop using the modules: "systemjs" option and migrate to native ES Modules or another module format (removes the vulnerable code path entirely, but changes your build output and may require code changes); or, only for legacy codebases that cannot upgrade, pin @babel/parser to v7.11.5 - with the significant side effect that this disables string module-name parsing and other newer language features, which can break the build pipeline. Regardless of version, ensure the pipeline never compiles untrusted third-party source; see the advisory at https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp.

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

EUVD-2026-31946 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy