🛡️ CVE-2026-49356 — babel

🟢 CVSS 3.2 — Low ✅ No Known Exploit CWE-200 NVD
3.2
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

@babel/core: Arbitrary File Read via sourceMappingURL Comment

Impact

Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are _all_ true:

  • the attacker controls the input source code
  • the attacker can read the output source code
  • the attacker knows the path of the source map file that they want to read

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/[email protected] and @babel/[email protected].

Workarounds

Callers can mitigate the issue without upgrading by setting [inputSourceMap: false](https://babeljs.io/docs/options#inputsourcemap) in their Babel options.

Callers can also manually extract the #sourceMappingURL comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to inputSourceMap (passing false when it's not).

Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is high, an attacker needs no privileges on the target. No user interaction is required. The scope is changed, meaning a successful attack can affect components beyond the vulnerable one. Rated impact: confidentiality low, integrity none, availability none.

Weakness class

CVE-2026-49356 is classified as CWE-200: Exposure of Sensitive Information. Information that should stay internal is disclosed to someone who is not authorised to see it.

Affected software

CVE-2026-49356 is recorded against 2 packages.

  • @babel/core
  • babel

Timeline and source

Published on 15 June 2026 and last revised on 15 July 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

github.com (Web)
nvd.nist.gov (Advisory)
babeljs.io (Web)
github.com (Package)

Details

Severity LOW
CVSS Score 3.2
CVSS Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
CWE CWE-200
Public Exploit ✅ No
Source NVD
Published 2026-06-15
Updated 2026-08-12
Modified 2026-07-15
Fix URL N/A

Affected Packages

Software From version Fixed in
@babel/core — —
babel — —

Free Vulnerability Check

Is your site affected by CVE-2026-49356?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against CVE-2026-49356 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.