{"id":"CVE-2026-49356","aliases":["GHSA-4x5r-pxfx-6jf8"],"url":"https://o3.security/vulnerability/CVE-2026-49356","summary":"Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core","details":"## Impact\n\nUsing `@babel/core` to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are _all_ true:\n- the attacker controls the input source code\n- the attacker can read the output source code\n- the attacker knows the path of the source map file that they want to read\n\n**Users that only compile trusted code are not impacted.**\n\n## Patches\n\nThe vulnerability has been fixed in `@babel/core@7.29.6` and `@babel/core@8.0.0-rc.6`.\n\n## Workarounds\n\nCallers can mitigate the issue without upgrading by setting [`inputSourceMap: false`](https://babeljs.io/docs/options#inputsourcemap) in their Babel options.\n\nCallers can also manually extract the `#sourceMappingURL` comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to `inputSourceMap` (passing `false` when it's not).\n\n## Credits\n\nThanks Teodor-Cristian Radoi for reporting the vulnerability.","published":"2026-06-22T16:07:01.764Z","modified":"2026-10-28T02:30:42.999304724Z","cvss":{"score":3.2,"severity":"LOW","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N"},"epss":{"score":0.00126,"percentile":0.02554,"asOf":"2026-09-02"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@babel/core","fixedVersion":"8.0.0-rc.6"},{"ecosystem":"npm","name":"@babel/core","fixedVersion":"7.29.6"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49356.json"},{"type":"ADVISORY","url":"https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49356"},{"type":"WEB","url":"https://babeljs.io/docs/options#inputsourcemap"},{"type":"PACKAGE","url":"https://github.com/babel/babel"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:42.999304724Z"}}