Executive brief
Babel is a popular tool used by developers to convert modern JavaScript code into versions compatible with older browsers. A vulnerability in its SystemJS module transformation plugin allows specially crafted source code to trick the compiler into generating malicious output. If a developer or automated system compiles untrusted code using this plugin, the resulting JavaScript could execute unauthorized commands on the end-user's machine or within the production environment.
Technical details
A code injection vulnerability (CWE-94) and type confusion (CWE-843) exist in @babel/plugin-transform-modules-systemjs. When Babel compiles specifically crafted malicious input using this plugin, it fails to properly neutralize special elements, leading to the generation of output code that can execute arbitrary JavaScript. The attack requires the victim to compile untrusted code using the affected plugin or @babel/preset-env with the 'systemjs' module option enabled. This is particularly relevant for web-based IDEs or build pipelines that process third-party contributions. The issue is resolved in version 7.29.4 and 8.0.0-alpha.13.
Affected products
- Babel @babel/plugin-transform-modules-systemjs >= 7.12.0, <= 7.29.3, >= 8.0.0-alpha.0, <= 8.0.0-alpha.12
- Babel @babel/preset-env Affected when using modules: 'systemjs' option
Timeline
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-26: disclosed: NVD publication date