Read the docs
TI-2026-32615 Aliases CVE-2026-44728GHSA-fv7c-fp4j-7gwp

Type confusion in babel

Priority LOW 36CWE-843Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-843 and the CVSS impact.

Summary

Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00125 2nd percentileScored 2026-11-07
Fix Fixed babel (babel): 7.29.4, 8.0.0-alpha.13plugin-transform-modules-systemjs (@babel): 7.29.4, 8.0.0-alpha.13+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
babelbabel7.12.0 to before 7.29.4; 8.0.0-alpha.0 to before 8.0.0-alpha.137.29.4, 8.0.0-alpha.13Patch availableCNA
babelplugin-transform-modules-systemjs7.12.0 to before 7.29.4; 8.0.0-alpha.0 to before 8.0.0-alpha.137.29.4, 8.0.0-alpha.13Patch availableCNA
—@babel/plugin-transform-modules-systemjs (npm)7.12.0 to before 7.29.47.29.4Patch availableGHSA-fv7c-fp4j-7gwp
—@babel/plugin-transform-modules-systemjs (npm)8.0.0-alpha.0 to before 8.0.0-alpha.138.0.0-alpha.13Patch availableGHSA-fv7c-fp4j-7gwp
  • babel Vendorbabel Affected 7.12.0 to before 7.29.4; 8.0.0-alpha.0 to before 8.0.0-alpha.13 Fixed in 7.29.4, 8.0.0-alpha.13 Patch available CNA
  • plugin-transform-modules-systemjs Vendorbabel Affected 7.12.0 to before 7.29.4; 8.0.0-alpha.0 to before 8.0.0-alpha.13 Fixed in 7.29.4, 8.0.0-alpha.13 Patch available CNA
  • @babel/plugin-transform-modules-systemjs (npm) Vendor— Affected 7.12.0 to before 7.29.4 Fixed in 7.29.4 Patch available GHSA-fv7c-fp4j-7gwp
  • @babel/plugin-transform-modules-systemjs (npm) Vendor— Affected 8.0.0-alpha.0 to before 8.0.0-alpha.13 Fixed in 8.0.0-alpha.13 Patch available GHSA-fv7c-fp4j-7gwp

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:babel:babel:*:*:*:*:*:*:*:*7.12.0 to before 7.29.4Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha0:*:*:*:*:*:*8.0.0 alpha0Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha1:*:*:*:*:*:*8.0.0 alpha1Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha10:*:*:*:*:*:*8.0.0 alpha10Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha11:*:*:*:*:*:*8.0.0 alpha11Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha12:*:*:*:*:*:*8.0.0 alpha12Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha2:*:*:*:*:*:*8.0.0 alpha2Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha3:*:*:*:*:*:*8.0.0 alpha3Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha4:*:*:*:*:*:*8.0.0 alpha4Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha5:*:*:*:*:*:*8.0.0 alpha5Vulnerablebabel
  • cpe:2.3:a:babel:babel:*:*:*:*:*:*:*:* Versions 7.12.0 to before 7.29.4 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha0:*:*:*:*:*:* Versions 8.0.0 alpha0 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha1:*:*:*:*:*:* Versions 8.0.0 alpha1 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha10:*:*:*:*:*:* Versions 8.0.0 alpha10 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha11:*:*:*:*:*:* Versions 8.0.0 alpha11 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha12:*:*:*:*:*:* Versions 8.0.0 alpha12 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha2:*:*:*:*:*:* Versions 8.0.0 alpha2 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha3:*:*:*:*:*:* Versions 8.0.0 alpha3 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha4:*:*:*:*:*:* Versions 8.0.0 alpha4 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha5:*:*:*:*:*:* Versions 8.0.0 alpha5 Vulnerable ·babel
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:babel:babel:8.0.0:alpha6:*:*:*:*:*:*8.0.0 alpha6Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha7:*:*:*:*:*:*8.0.0 alpha7Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha8:*:*:*:*:*:*8.0.0 alpha8Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha9:*:*:*:*:*:*8.0.0 alpha9Vulnerablebabel
  • cpe:2.3:a:babel:babel:8.0.0:alpha6:*:*:*:*:*:* Versions 8.0.0 alpha6 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha7:*:*:*:*:*:* Versions 8.0.0 alpha7 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha8:*:*:*:*:*:* Versions 8.0.0 alpha8 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha9:*:*:*:*:*:* Versions 8.0.0 alpha9 Vulnerable ·babel

Remediation

  • Fix · CNA babel (babel) Fixed in 7.29.4, 8.0.0-alpha.13
  • Fix · CNA plugin-transform-modules-systemjs (@babel) Fixed in 7.29.4, 8.0.0-alpha.13
  • Fix · GHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs (npm) Fixed in 7.29.4 Advisory →
  • Fix · GHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs (npm) Fixed in 8.0.0-alpha.13 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44728
  2. 2026-10-03 Alias added: GHSA-fv7c-fp4j-7gwp

References

Advisory 2

Other 1

  • TI-2026-36529 Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core CVSS 3.1LOW 3.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences