GHSA-fv7c-fp4j-7gwpPublished

Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs

cve-program · CVE-2026-44728

Published

babel

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "babel",
                    "product": "babel",
                    "versions": [
                        {
                            "version": ">= 7.12.0, < 7.29.4",
                            "status": "affected"
                        },
                        {
                            "version": ">= 8.0.0-alpha.0, < 8.0.0-alpha.13",
                            "status": "affected"
                        }
                    ]
                }

plugin-transform-modules-systemjs

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "@babel",
                    "product": "plugin-transform-modules-systemjs",
                    "versions": [
                        {
                            "version": ">= 7.12.0, < 7.29.4",
                            "status": "affected"
                        },
                        {
                            "version": ">= 8.0.0-alpha.0, < 8.0.0-alpha.13",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-31946

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: May 26, 2026, 5:48:57 PM

dateUpdated: May 28, 2026, 3:55:38 AM

2 related source bulletins · separate from aliases

WID-SEC-W-2026-3376: Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachstellen

CVE-2022-46175 · CVE-2026-12143 · CVE-2026-12802 · CVE-2026-12803 · CVE-2026-12816 · CVE-2026-13506 · CVE-2026-13676 · CVE-2026-14257 · CVE-2026-14682 · CVE-2026-16221 · CVE-2026-18446 · CVE-2026-21582 · CVE-2026-42583 · CVE-2026-44249 · CVE-2026-44728 · CVE-2026-45416 · CVE-2026-45623 · CVE-2026-45674 · CVE-2026-47691 · CVE-2026-47759 · CVE-2026-47761 · CVE-2026-47762 · CVE-2026-4800 · CVE-2026-48043 · CVE-2026-48801 · CVE-2026-50010 · CVE-2026-53404 · CVE-2026-53434 · CVE-2026-54428 · CVE-2026-54512 · CVE-2026-54513 · CVE-2026-55153 · CVE-2026-55276 · CVE-2026-55831 · CVE-2026-55833 · CVE-2026-56745 · CVE-2026-56819 · CVE-2026-58059 · CVE-2026-58060 · CVE-2026-59639 · CVE-2026-59642 · CVE-2026-59650 · CVE-2026-59869 · CVE-2026-59879 · CVE-2026-59880 · CVE-2026-59887 · CVE-2026-59901 · CVE-2026-67213 · CVE-2026-67214 · CVE-2026-67320 · CVE-2026-68763 · CVE-2026-69152 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-73507 · CVE-2026-73566 · CVE-2026-73646 · CVE-2026-75140 · CVE-2026-75595 · CVE-2026-75899 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-8763

WID-SEC-W-2026-3046: IBM Concert: Mehrere Schwachstellen

CVE-2019-19921 · CVE-2021-23337 · CVE-2024-3651 · CVE-2024-39338 · CVE-2024-45590 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-15599 · CVE-2025-22874 · CVE-2025-47273 · CVE-2025-47907 · CVE-2025-52881 · CVE-2025-53643 · CVE-2025-55184 · CVE-2025-58056 · CVE-2025-58188 · CVE-2025-58189 · CVE-2025-61723 · CVE-2025-61730 · CVE-2025-64649 · CVE-2025-64756 · CVE-2025-67221 · CVE-2025-68121 · CVE-2025-68146 · CVE-2026-0540 · CVE-2026-2327 · CVE-2026-23490 · CVE-2026-23897 · CVE-2026-2391 · CVE-2026-23949 · CVE-2026-24486 · CVE-2026-25528 · CVE-2026-25547 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26019 · CVE-2026-26996 · CVE-2026-27142 · CVE-2026-27212 · CVE-2026-27699 · CVE-2026-27903 · CVE-2026-27904 · CVE-2026-28684 · CVE-2026-29063 · CVE-2026-29181 · CVE-2026-2950 · CVE-2026-31808 · CVE-2026-31900 · CVE-2026-32274 · CVE-2026-32288 · CVE-2026-32597 · CVE-2026-32630 · CVE-2026-32887 · CVE-2026-32952 · CVE-2026-33186 · CVE-2026-33532 · CVE-2026-33750 · CVE-2026-33814 · CVE-2026-33816 · CVE-2026-33916 · CVE-2026-34043 · CVE-2026-34073 · CVE-2026-34077 · CVE-2026-3520 · CVE-2026-35469 · CVE-2026-35515 · CVE-2026-3627 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-39892 · CVE-2026-39984 · CVE-2026-40175 · CVE-2026-40179 · CVE-2026-40181 · CVE-2026-40190 · CVE-2026-40347 · CVE-2026-41066 · CVE-2026-41182 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-41305 · CVE-2026-41324 · CVE-2026-41425 · CVE-2026-41481 · CVE-2026-41488 · CVE-2026-41602 · CVE-2026-41636 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42198 · CVE-2026-42211 · CVE-2026-42338 · CVE-2026-42342 · CVE-2026-42561 · CVE-2026-42577 · CVE-2026-43870 · CVE-2026-44405 · CVE-2026-44431 · CVE-2026-44432 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44496 · CVE-2026-44728 · CVE-2026-4539 · CVE-2026-45409 · CVE-2026-45736 · CVE-2026-46625 · CVE-2026-4800 · CVE-2026-4923 · CVE-2026-4926 · CVE-2026-7246 · CVE-2026-8723

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-44728

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-94 · CWE-843

Original publisher date fields

published: 2026-05-26T18:16:50.880

lastModified: 2026-07-24T11:10:00.170

14 source CPE criteria · context only

cpe:2.3:a:babel:babel:*:*:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha0:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha10:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha11:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha12:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha3:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha4:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha5:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha6:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha7:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha8:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha9:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-fv7c-fp4j-7gwp

Published

@babel/plugin-transform-modules-systemjs

npm

SEMVER · introduced 7.12.0 → fixed 7.29.4

@babel/plugin-transform-modules-systemjs

npm

SEMVER · introduced 8.0.0-alpha.0 → fixed 8.0.0-alpha.13

Original source record · Cite this exact observation · Complete original publisher JSON