PT-2026-39295 · Npm+2 · @Babel/Plugin-Transform-Modules-Systemjs+1

Daniel-Msft · Published 2026-05-08 · Updated 2026-05-26 · CVE-2026-44728

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Babel versions 7.12.0 through 7.29.3 Babel versions 8.0.0-alpha.1 through 8.0.0-alpha.12

Description Compiling code specifically crafted by an attacker can cause the generation of output code that executes arbitrary code. This issue affects the @babel/plugin-transform-modules-systemjs plugin and @babel/preset-env when the modules: "systemjs" option is used, as it delegates to the affected plugin. Users who only compile trusted code are not impacted.

Recommendations Update to version 7.29.4 or 8.0.0-alpha.13. Update @babel/preset-env to version 7.29.5. As a temporary workaround, pin @babel/parser to v7.11.5, though this may disable new language features and cause build pipeline failures. Avoid using the modules: "systemjs" option and migrate the codebase to native ES Modules or other module formats.

Fix

Type Confusion

Code Injection

Weakness Enumeration

CWE-843

CWE-94

Related Identifiers

CVE-2026-44728

GHSA-FV7C-FP4J-7GWP

Affected Products

@Babel/Plugin-Transform-Modules-Systemjs

Babel

References · 5

• https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44728 · Security Note
• https://osv.dev/vulnerability/GHSA-fv7c-fp4j-7gwp · Vendor Advisory
• https://github.com/babel/babel · Note