Description
Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code.
Recommendation
Update the @babel/plugin-transform-modules-systemjs package to the latest compatible version. Followings are version details:
Affected version(s): **>= 8.0.0-alpha.0, <= 8.0.0-alpha.12 >= 7.12.0, <= 7.29.3** Patched version(s): **8.0.0-alpha.13 7.29.4**
References
Could your website be exposed too?
SmartScanner can check your website for @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - CVE-2023-45133
- Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas - CVE-2026-41138
- Electerm runWidget has a path traversal that leads to arbitrary code execution - CVE-2026-43940
- eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code - CVE-2025-54313
You might also like:
See something that needs correcting? Let us knowUpdated June 08, 2026