Most recent entries from all

bdu:2026-08998

certfr-2026-avi-1094 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-1094

CLEANSTART-2026-GA82552 — Babel is a compiler for writing next generation JavaScript

Affected: CleanStart: argo-workflows

Security vulnerability affects the argo-workflows package. Babel is a compiler for writing next generation JavaScript.

EUVD-2026-322304

fkie_cve-2026-44728

Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.

GHSA-fv7c-fp4j-7gwp — @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

Affected: npm: @babel/plugin-transform-modules-systemjs

### Impact

Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code.

Known affected plugins are: - `@babel/plugin-transform-modules-systemjs` - `@babel/preset-env` when using the [`modules: "systemjs"` option](https://babel.dev/docs/babel-preset-env#modules), as it delegates to `@babel/plugin-transform-modules-systemjs`

No other plugins under the `@babel` namespace are impacted.

**Users that only compile trusted code are not impacted.**

### Patches

The vulnerability has been fixed in `@babel/plugin-transform-modules-systemjs@7.29.4`.

Babel also released `@babel/preset-env@7.29.5`, updating its `@babel/plugin-transform-modules-systemjs` dependency, to simplify forcing the update if you are using `@babel/preset-env` directly.

### Workarounds

- Pin `@babel/parser` to v7.11.5. The downgrade will completely disable string module name parsing, but it would also disable other new language features and the build pipeline may fail as a result. Only do so if you are working on a legacy codebase and can not upgrade `@babel/plugin-transform-modules-systemjs` to v7.29.4. - Do not use the `modules: "systemjs"` option, migrate the codebase to native ES Modules or any other module formats.

### Credits Babel thanks Daniel Cervera for reporting the vulnerability.

UBUNTU-CVE-2026-44728

Affected: Ubuntu:22.04:LTS: node-babel7, Ubuntu:24.04:LTS: node-babel7, Ubuntu:25.10: node-babel7, Ubuntu:26.04:LTS: node-babel7

WID-SEC-W-2026-3046 — IBM Concert: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.