Node babel7: Babel is a compiler for writing next generation JavaScript. (CVE-2026-44728)
Description
A vulnerability in Babel versions from 7.12.0 up to but not including 7.29.4 and in 8.0.0-alpha.13 allows an attacker to craft input code that causes Babel to generate output code capable of executing arbitrary code. This issue has been fixed in version 7.29.4 and 8.0.0-alpha.13.
CVSS v3.1
Score 8.2high
Affected software
pkg:deb/ubuntu/node-babel7?arch=source&distro=jammypkg:deb/ubuntu/node-babel7?arch=source&distro=noblepkg:deb/ubuntu/node-babel7?arch=source&distro=questingpkg:deb/ubuntu/node-babel7?arch=source&distro=stonkingpkg:deb/ubuntu/node-babel7?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Babel, a JavaScript compiler, contains a vulnerability in versions 7.12.0 through before 7.29.4 and 8.0.0-alpha.13 where processing specially crafted input code can lead to generation of output code that executes arbitrary code. This allows an attacker with the ability to supply code to Babel to cause arbitrary code execution in the compiled output. The issue is resolved in Babel 7.29.4 and 8.0.0-alpha.13.
Potential Impact
Successful exploitation allows an attacker with limited privileges and user interaction to cause Babel to generate JavaScript code that executes arbitrary commands, potentially leading to full compromise of the environment where the compiled code runs. The CVSS score of 8.2 reflects high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade Babel to version 7.29.4 or later, or to 8.0.0-alpha.13 or later. No other mitigations are indicated. Patch status is confirmed fixed in these versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-44728
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:25.10","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6ad3f6632cdf04f656666230
Added to database: 10/17/2026, 22:27:47 UTC
Last enriched: 10/18/2026, 01:32:25 UTC
Last updated: 10/18/2026, 01:32:25 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.