Description
Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.
Affected products
babel: babel
References1
- github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp MitigationVendor Advisory
Metrics
- CVSS 3.1
-
7.8
HIGH
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 2 · as of 14 November 2026
- CWE
- CWE-94CWE-843
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.