{"id":"CVE-2026-49356","aliases":["GHSA-4x5r-pxfx-6jf8"],"title":"@babel/core: Arbitrary File Read via sourceMappingURL Comment","summary":"@babel/core: Arbitrary File Read via sourceMappingURL Comment","severity":"low","cvss":3.2,"cwe":["CWE-22","CWE-200"],"vendor":"babel","product":"@babel/core","ecosystem":"npm","affected":["@babel/core >= 8.0.0-alpha.0, < 8.0.0-rc.5","@babel/core <= 7.29.0"],"patched":["@babel/core 8.0.0-rc.6","@babel/core 7.29.6"],"published":"2026-06-15","updated":"2026-06-15","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-4x5r-pxfx-6jf8","references":[{"url":"https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8"},{"url":"https://babeljs.io/docs/options#inputsourcemap"},{"url":"https://github.com/advisories/GHSA-4x5r-pxfx-6jf8"}],"tags":["ghsa","npm"],"epss":0.00126,"epssPercentile":0.02625,"ingestedAt":"2026-07-07T15:41:58.944Z","slug":"CVE-2026-49356","body":"## Overview\n\n## Impact\n\nUsing `@babel/core` to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are _all_ true:\n- the attacker controls the input source code\n- the attacker can read the output source code\n- the attacker knows the path of the source map file that they want to read\n\n**Users that only compile trusted code are not impacted.**\n\n## Patches\n\nThe vulnerability has been fixed in `@babel/core@7.29.6` and `@babel/core@8.0.0-rc.6`.\n\n## Workarounds\n\nCallers can mitigate the issue without upgrading by setting [`inputSourceMap: false`](https://babeljs.io/docs/options#inputsourcemap) in their Babel options.\n\nCallers can also manually extract the `#sourceMappingURL` comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to `inputSourceMap` (passing `false` when it's not).\n\n## Credits\n\nThanks Teodor-Cristian Radoi for reporting the vulnerability.\n\n## Affected packages\n\n- `@babel/core >= 8.0.0-alpha.0, < 8.0.0-rc.5`\n- `@babel/core <= 7.29.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@babel/core 8.0.0-rc.6`\n- `@babel/core 7.29.6`","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":17.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}