CVE-2026-49356

LOW EPSS 1.9%

Published Jun 22, 20261w ago · Modified Jun 23, 20261w ago

3.2 CVSS 3.1

Low

Published Jun 22, 2026 1w ago

Last Modified Jun 23, 2026 1w ago

Description

Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.

CVSS Details

Base Score

3.2

Exploitability

1.4

Impact

1.4

Vector string

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Attack Vector Local

Attack Complexity High

Privileges Required None

User Interaction None

Scope Changed

Confidentiality Low

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

1.9% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 2

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure

CWE-22 Path Traversal Resource Mgmt

References 1

github.com https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.