High, CVSS 8.2npmAmendedPublished
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
CVE-2026-44728 · GHSA-fv7c-fp4j-7gwp
- Affected
- npm @babel/plugin-transform-modules-systemjs >= 7.12.0, <= 7.29.3; >= 8.0.0-alpha.0, <= 8.0.0-alpha.12
- Fixed in
- 7.29.48.0.0-alpha.13· Vendor fix available
- Issue
- Impact Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. Known affected plugins are: - @babel/plugin-transform-modules-systemjs - @babel/preset-env when using the modules: "systemjs" option, as it delegates to @babel/plugin-transform-modules-systemjs No other plugins under the @babel namespace are impacted. Users that only compile trusted code are not impacted. Patches The vulnerability has been fixed in @babel/plugin-transform-modules-systemjs@7.29.4. Babel also released @babel/preset-env@7.29.5, updating its @babel/plugin-transform-modules-systemjs dependency, to simplify forcing the update if you are using @babel/preset-env directly. Workarounds - Pin @babel/parser to v7.11.5. The downgrade will completely disable string module name parsing, but it would also disable other new language features and the build pipeline may fail as a result. Only do so if you are working on a legacy codebase…
Recommended action: Upgrade to 8.0.0-alpha.13 (pre-release) or 7.29.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.