GHSA-fv7c-fp4j-7gwp
High · 8.2CVSS
8.2
EPSS
—
Published
May 8, 2026
CISA due date
—
The record
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @babel/plugin-transform-modules-systemjs | 7.12.0 | 7.29.4 |
| npm | @babel/plugin-transform-modules-systemjs | 8.0.0-alpha.0 | 8.0.0-alpha.13 |
Related vulnerabilities
- CVE-2026-44728 Babel is a compiler for writing next generation JavaScript. Same vulnerability
- CVE-2026-109282 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in… CWE-843
- CVE-2026-106587 In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes… CWE-843
- CVE-2026-106446 Handlebars provides the power necessary to let users build semantic templates. CWE-843
- CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-843
- CVE-2026-15461 The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later… CWE-843
- CVE-2026-87636 Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker… CWE-843
- CVE-2026-87612 Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to… CWE-843