{"id":"CVE-2026-44728","sourceIdentifier":"security-advisories@github.com","published":"2026-05-26T18:16:50.880","lastModified":"2026-07-24T11:10:00.170","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13."},{"lang":"es","value":"Babel es un compilador para escribir JavaScript de próxima generación. Desde la versión 7.12.0 hasta antes de la 7.29.4 y la 8.0.0-alpha.13, usar Babel para compilar código que fue específicamente diseñado por un atacante puede hacer que Babel genere código de salida que ejecuta código arbitrario. Esta vulnerabilidad está corregida en la 7.29.4 y la 8.0.0-alpha.13."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"babel","product":"babel","versions":[{"version":">= 7.12.0, < 7.29.4","status":"affected"},{"version":">= 8.0.0-alpha.0, < 8.0.0-alpha.13","status":"affected"}]},{"vendor":"@babel","product":"plugin-transform-modules-systemjs","versions":[{"version":">= 7.12.0, < 7.29.4","status":"affected"},{"version":">= 8.0.0-alpha.0, < 8.0.0-alpha.13","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-27T00:00:00+00:00","id":"CVE-2026-44728","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-843"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:babel:babel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.12.0","versionEndExcluding":"7.29.4","matchCriteriaId":"284B552B-0419-42FB-A5B4-2C214887D1E9"},{"vulnerable":true,"criteria":"cpe:2.3:a:babel:babel:8.0.0:alpha0:*:*:*:*:*:*","matchCriteriaId":"35F6AF6B-8CB6-40BB-B0AE-32E89718ED8C"},{"vulnerable":true,"criteria":"cpe:2.3:a:babel:babel:8.0.0:alpha1:*:*:*:*:*:*","matchCriteriaId":"DAFA4C96-CD2A-47A5-BA4E-134BA1D366B3"},{"vulnerable":true,"criteria":"cpe:2.3:a:babel:babel:8.0.0:alpha10:*:*:*:*:*:*","matchCriteriaId":"BAC310EC-C0CF-4D27-BA54-20B3207B4118"},{"vulnerable":true,"criteria":"cpe:2.3:a:babel:babel:8.0.0:alpha11:*:*:*:*:*:*","matchCriteriaId":"80E37BB6-34C2-437B-A9DC-018B23F5E7BD"},{"vulnerable":true,"criteria":"cpe:2.3:a:babel:babel:8.0.0:alpha12:*:*:*:*:*:*","matchCriteriaId":"B74C4261-EB8F-448D-AF41-CB82246C3EB4"},{"vulnerable":true,"criteria":"cpe:2.3:a:babel:babel:8.0.0:alpha2:*:*:*:*:*:*","matchCriteriaId":"BD426CF6-E4B7-4F65-9968-A485F745E377"},{"vulnerable":true,"criteria":"cpe:2.3:a:babel:babel:8.0.0:alpha3:*:*:*:*:*:*","matchCriteriaId":"92CE9983-D67E-4DE6-B9EE-CCE55DF615E7"},{"vulnerable":true,"criteria":"cpe:2.3:a:babel:babel:8.0.0:alpha4:*:*:*:*:*:*","matchCriteriaId":"66E5DE6B-CD6D-4687-AB1C-90B294DE8DCC"},{"vulnerable":true,"criteria":"cpe:2.3:a:babel:babel:8.0.0:alpha5:*:*:*:*:*:*","matchCriteriaId":"5E3BD45A-177D-4006-8820-EEABE6EF03FC"},{"vulnerable":true,"criteria":"cpe:2.3:a:babel:babel:8.0.0:alpha6:*:*:*:*:*:*","matchCriteriaId":"D9323EF4-77AA-410A-A2F7-D905C6175A64"},{"vulnerable":true,"criteria":"cpe:2.3:a:babel:babel:8.0.0:alpha7:*:*:*:*:*:*","matchCriteriaId":"67E62B17-72F2-464F-AB14-E7A9F744AC01"},{"vulnerable":true,"criteria":"cpe:2.3:a:babel:babel:8.0.0:alpha8:*:*:*:*:*:*","matchCriteriaId":"BDC6F0F5-3141-41CD-B8D0-13AE9FF4FFEC"},{"vulnerable":true,"criteria":"cpe:2.3:a:babel:babel:8.0.0:alpha9:*:*:*:*:*:*","matchCriteriaId":"FC459C4A-04F3-4521-A7EA-A03A118AA4F0"}]}]}],"references":[{"url":"https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}