StackRadar

CVE-2026-44728

High

Advisory

Published 8 May 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.001
3rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
80
of 17,781 indexed, latest versions
Container images
73
deployed by those charts
Fix available
1 of 2
affected packages

@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

Carried by container images the latest versions of 80 of 17,781 indexed charts deploy, on 73 images.

Affected packageAffected versionsFixed inImages
@babel/plugin-transform-modules-systemjsnpm7.12.1, 7.12.13, 7.13.8, 7.14.5+21 more7.29.473
node-babel7deb7.20.15+ds1+~cs214.269.168-6build1no fix listed1
OSV records
GHSA-fv7c-fp4j-7gwpUBUNTU-CVE-2026-44728

Charts affected

80 by stars
ChartLatestAffected imagesRadar Score
myawesomeapp-marmyawesomeapp-mar0.1.11 of 1See more

myawesomeapp-mar myawesomeapp-mar 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
winfred008/amazon:910a68de5b398
@babel/plugin-transform-modules-systemjs@7.20.11
7.29.4

Open the chart page →

2,116
myweatherhelmmyweather1.3.111 of 7See more

myweatherhelm myweather 1.3.11

1 of the 7 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
@babel/plugin-transform-modules-systemjs@7.20.11
7.29.4

Open the chart page →

17,929
dashynas-helm-chartsVerified publisher1.0.41 of 1See more

dashy nas-helm-charts 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
lissy93/dashy:2.0.51991f7be5ed0
@babel/plugin-transform-modules-systemjs@7.16.7
7.29.4

Open the chart page →

3,269
notes-admin-front-helm-chartnotesprojectchart0.1.01 of 1See more

notes-admin-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
vlebediantsev/notes-admin-front:latest007c6670ff48
@babel/plugin-transform-modules-systemjs@7.22.5
7.29.4

Open the chart page →

15,132
notes-project-fromt-helm-chartnotesprojectchart0.1.01 of 1See more

notes-project-fromt-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
vlebediantsev/notes-project-front:latest945675fd2636
@babel/plugin-transform-modules-systemjs@7.22.5
7.29.4

Open the chart page →

15,206
registration-ms-front-helm-chartnotesprojectchart0.1.01 of 1See more

registration-ms-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
@babel/plugin-transform-modules-systemjs@7.20.11
7.29.4

Open the chart page →

15,187
flomesh-consoleopenshift0.70.0-30-ubi81 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

1 of the 2 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
@babel/plugin-transform-modules-systemjs@7.15.4
7.29.4

Open the chart page →

9,968
mastodonrivals-spaceVerified publisher3.1.21 of 3See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
@babel/plugin-transform-modules-systemjs@7.19.6
7.29.4

Open the chart page →

6,026
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
@babel/plugin-transform-modules-systemjs@7.23.0
7.29.4

Open the chart page →

7,413
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
@babel/plugin-transform-modules-systemjs@7.20.11
7.29.4

Open the chart page →

4,431
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
@babel/plugin-transform-modules-systemjs@7.25.0
7.29.4

Open the chart page →

5,497
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
@babel/plugin-transform-modules-systemjs@7.24.7
7.29.4

Open the chart page →

1,991
dashysergiotocaliniVerified publisher1.0.01 of 1See more

dashy sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
@babel/plugin-transform-modules-systemjs@7.18.4
7.29.4

Open the chart page →

3,143
sneakerssneakers1.0.01 of 4See more

sneakers sneakers 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
helga09/shoes_ukr:v1.1.17999bc8b77c0
@babel/plugin-transform-modules-systemjs@7.20.11
7.29.4

Open the chart page →

7,574
speedtest-trackersoblivionscall3.0.41 of 1See more

speedtest-tracker soblivionscall 3.0.4

1 of the 1 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
henrywhitaker3/speedtest-tracker:latest47159a940229
@babel/plugin-transform-modules-systemjs@7.12.1
7.29.4

Open the chart page →

2,460
pwssoketi0.2.41 of 1See more

pws soketi 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
quay.io/soketi/pws:0.8-16-alpine399d2e6b10ef
@babel/plugin-transform-modules-systemjs@7.15.4
7.29.4

Open the chart page →

3,228
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
@babel/plugin-transform-modules-systemjs@7.17.8
7.29.4

Open the chart page →

16,368
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
@babel/plugin-transform-modules-systemjs@7.17.8
7.29.4

Open the chart page →

16,400
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f81 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

1 of the 5 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
@babel/plugin-transform-modules-systemjs@7.17.8
7.29.4

Open the chart page →

14,679
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
@babel/plugin-transform-modules-systemjs@7.17.8
7.29.4

Open the chart page →

16,400
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4691 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

1 of the 5 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d4694bd113093583
@babel/plugin-transform-modules-systemjs@7.17.8
7.29.4

Open the chart page →

14,221
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3411 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

1 of the 5 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.12-branch.testing3.88744-f55b3414bd113093583
@babel/plugin-transform-modules-systemjs@7.17.8
7.29.4

Open the chart page →

14,221
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
@babel/plugin-transform-modules-systemjs@7.17.8
7.29.4

Open the chart page →

16,019
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
@babel/plugin-transform-modules-systemjs@7.17.8
7.29.4

Open the chart page →

15,635
nordmart-reviewstakaterVerified publisher0.0.61 of 3See more

nordmart-review stakater 0.0.6

1 of the 3 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
stakater/stakater-nordmart-review-ui:1.0.143f4926eedc74
@babel/plugin-transform-modules-systemjs@7.13.8
7.29.4

Open the chart page →

11,554
nordmart-review-instancestakaterVerified publisher1.0.01 of 3See more

nordmart-review-instance stakater 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
stakater/stakater-nordmart-review-ui:1.0.143f4926eedc74
@babel/plugin-transform-modules-systemjs@7.13.8
7.29.4

Open the chart page →

11,554
fdi-dotstatsuite-dlmstatcan0.3.11 of 1See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
@babel/plugin-transform-modules-systemjs@7.14.5
7.29.4

Open the chart page →

3,881
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
samajh/alprfrontend:latest05ef4fddbb75
@babel/plugin-transform-modules-systemjs@7.19.0
7.29.4

Open the chart page →

20,270
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
@babel/plugin-transform-modules-systemjs@7.25.9
7.29.4

Open the chart page →

5,984
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-44728.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
@babel/plugin-transform-modules-systemjs@7.12.1
7.29.4

Open the chart page →

10,127

Container images carrying it

73 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
@babel/plugin-transform-modules-systemjs@7.17.8
7.29.4
1
treskon/portrait-ui:DEV-lateste7970783bc8d
@babel/plugin-transform-modules-systemjs@7.23.9
7.29.4
1
ubercadence/web:v3.29.58564a5b44a6d
@babel/plugin-transform-modules-systemjs@7.12.1
7.29.4
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
@babel/plugin-transform-modules-systemjs@7.25.0
7.29.4
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
@babel/plugin-transform-modules-systemjs@7.16.5
7.29.4
1
vlebediantsev/notes-admin-front:latest007c6670ff48
@babel/plugin-transform-modules-systemjs@7.22.5
7.29.4
1
vlebediantsev/notes-project-front:latest945675fd2636
@babel/plugin-transform-modules-systemjs@7.22.5
7.29.4
1
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
@babel/plugin-transform-modules-systemjs@7.20.11
7.29.4
1
winfred008/amazon:910a68de5b398
@babel/plugin-transform-modules-systemjs@7.20.11
7.29.4
1
ghcr.io/data-fair/metrics:0a8d40779eeae
@babel/plugin-transform-modules-systemjs@7.16.0
7.29.4
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
@babel/plugin-transform-modules-systemjs@7.24.7
7.29.4
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
@babel/plugin-transform-modules-systemjs@7.28.5
7.29.4
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
@babel/plugin-transform-modules-systemjs@7.19.6
7.29.4
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
@babel/plugin-transform-modules-systemjs@7.19.6
7.29.4
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
@babel/plugin-transform-modules-systemjs@7.12.1
7.29.4
1
ghcr.io/sct/overseerr:1.35.06197516c9d7b
@babel/plugin-transform-modules-systemjs@7.20.11
7.29.4
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
@babel/plugin-transform-modules-systemjs@7.25.0
7.29.4
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
@babel/plugin-transform-modules-systemjs@7.24.7
7.29.4
1
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
@babel/plugin-transform-modules-systemjs@7.25.9
7.29.4
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
@babel/plugin-transform-modules-systemjs@7.15.4
7.29.4
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
@babel/plugin-transform-modules-systemjs@7.12.1
7.29.4
1
quay.io/soketi/pws:0.8-16-alpine399d2e6b10ef
@babel/plugin-transform-modules-systemjs@7.15.4
7.29.4
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
@babel/plugin-transform-modules-systemjs@7.27.1
7.29.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.