---
id: CVE-2026-49356
aliases:
  - GHSA-4x5r-pxfx-6jf8
title: '@babel/core: Arbitrary File Read via sourceMappingURL Comment'
summary: '@babel/core: Arbitrary File Read via sourceMappingURL Comment'
severity: low
cvss: 3.2
cwe:
  - CWE-22
  - CWE-200
vendor: babel
product: '@babel/core'
ecosystem: npm
affected:
  - '@babel/core >= 8.0.0-alpha.0, < 8.0.0-rc.5'
  - '@babel/core <= 7.29.0'
patched:
  - '@babel/core 8.0.0-rc.6'
  - '@babel/core 7.29.6'
published: '2026-06-15'
updated: '2026-06-15'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-4x5r-pxfx-6jf8'
references:
  - url: 'https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8'
  - url: 'https://babeljs.io/docs/options#inputsourcemap'
  - url: 'https://github.com/advisories/GHSA-4x5r-pxfx-6jf8'
tags:
  - ghsa
  - npm
epss: 0.00126
epssPercentile: 0.02619
ingestedAt: '2026-07-07T15:41:58.944Z'
---

## Overview

## Impact

Using `@babel/core` to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are _all_ true:
- the attacker controls the input source code
- the attacker can read the output source code
- the attacker knows the path of the source map file that they want to read

**Users that only compile trusted code are not impacted.**

## Patches

The vulnerability has been fixed in `@babel/core@7.29.6` and `@babel/core@8.0.0-rc.6`.

## Workarounds

Callers can mitigate the issue without upgrading by setting [`inputSourceMap: false`](https://babeljs.io/docs/options#inputsourcemap) in their Babel options.

Callers can also manually extract the `#sourceMappingURL` comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to `inputSourceMap` (passing `false` when it's not).

## Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.

## Affected packages

- `@babel/core >= 8.0.0-alpha.0, < 8.0.0-rc.5`
- `@babel/core <= 7.29.0`

## Remediation

Upgrade to a patched release:

- `@babel/core 8.0.0-rc.6`
- `@babel/core 7.29.6`