CVE-2026-49356 Details
Description
Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.
An arbitrary file read vulnerability has been identified in Babel's @babel/core package, affecting versions 8.0.0-alpha.0 through 8.0.0-rc.5 and 7.29.0 and prior. The issue arises from the handling of sourceMappingURL comments, which can be exploited to read any source map file from the system running Babel. This vulnerability is exploitable if the attacker controls the input source code, can access the output source code, and knows the path of the source map file they wish to read. Users who only compile trusted code are not impacted.
The vulnerability has been patched in @babel/core versions 8.0.0-rc.6 and 7.29.6. Users can also mitigate the issue by setting inputSourceMap: false in their Babel options or by manually managing sourceMappingURL comments and input source maps.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| babel babel | < 7.29.6 8.0.0 alpha0 8.0.0 alpha1 8.0.0 alpha10 8.0.0 alpha11 8.0.0 alpha12 8.0.0 alpha13 8.0.0 alpha14 8.0.0 alpha15 8.0.0 alpha16 8.0.0 alpha17 8.0.0 alpha2 8.0.0 alpha3 8.0.0 alpha4 8.0.0 alpha5 8.0.0 alpha6 8.0.0 alpha7 8.0.0 alpha8 8.0.0 alpha9 8.0.0 beta0 8.0.0 beta1 8.0.0 beta2 8.0.0 beta3 8.0.0 beta4 8.0.0 rc1 8.0.0 rc2 8.0.0 rc3 8.0.0 rc4 8.0.0 rc5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |