Vulnerability · Published Jun 22, 2026 · Assigned by GitHub_M
CVE-2026-49356Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core
Low 3.2
In plain English
A low-severity path traversal in babel from babel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-babel7 | no fix listed | DEBIAN-CVE-2026-49356 |
| Debian:13 | node-babel7 | no fix listed | DEBIAN-CVE-2026-49356 |
| Debian:14 | node-babel7 | 8.0.4+ds1+~cs177.303.116-2 | DEBIAN-CVE-2026-49356 |
| npm | @babel/core | 8.0.0-rc.6 | GHSA-4x5r-pxfx-6jf8 |
| npm | @babel/core | 7.29.6 | GHSA-4x5r-pxfx-6jf8 |
Affected products (as reported)
Weakness: CWE-22, CWE-200 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
References
- https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8 x_refsource_CONFIRM