Skip to content
Fencer Vulns
low 3.2

CVE-2026-49356 json

Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core

published 2026-06-15 4 mo ago modified 2026-09-10 1 mo ago also GHSA-4x5r-pxfx-6jf8 , EUVD-2026-38302

cvss
3.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 4%
public exploits
0
none known

Summary

Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.

Patch / fix

  • npm @babel/core 7.29.6, 8.0.0-rc.6
  • babel babel 7.29.6
  • node-babel7 Debian 14 8.0.4+ds1+~cs177.303.116-2

debian advisories DEBIAN-CVE-2026-49356

  • velociraptor openSUSE Tumbleweed 0.76.7.0.git145.b60ef1146-1.1
  • agama-web-ui openSUSE Tumbleweed 24+0.a836cced5-52.1
  • agama-web-ui openSUSE Leap 16.0 17+673.b97ba64d6-160000.12.1

opensuse advisories openSUSE-SU-2026:12070-1openSUSE-SU-2026:11680-1openSUSE-SU-2026:21448-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-49356 updated cvss 3.6

@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment

  • Red Hat Cryostat 4 core, grafana-infinity-datasource-npm, cryostat-openshift-console-plugin-npm Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8
    +32 more products
    Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/kiali-ossmc-rhel9, openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle Red Hat 3scale API Management Platform 2 3scale-amp21/system, 3scale-amp22/system, 3scale-amp2/system-rhel7, 3scale-amp2/system-rhel8, 3scale-amp2/system-rhel9 Red Hat AMQ Broker 7 core Red Hat Ansible Automation Platform 2 automation-gateway, automation-controller, automation-platform-ui, automation-eda-controller, ansible-automation-platform-26/gateway-rhel9, ansible-automation-platform-27/gateway-rhel9, +4 more Red Hat build of Apache Camel - HawtIO 4 core Red Hat build of Apache Camel for Spring Boot 4 core Red Hat Build of Keycloak core Red Hat Build of Podman Desktop rh-podman-desktop.git Red Hat Ceph Storage 9 rhceph/alloy-rhel10 Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9 Red Hat Data Grid 8 core Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Discovery 2 discovery/discovery-ui-rhel9 Red Hat Enterprise Linux 8 pcs, grafana, pcs-snmp, grafana-loki, grafana-mssql, grafana-mysql, +10 more Red Hat Enterprise Linux 9 gjs, pcs, grafana, pcs-snmp, grafana-selinux Red Hat Enterprise Linux 10 gjs, grafana Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat Fuse 7 core Red Hat Hardened Images nodejs26, dotnet8.0 Red Hat JBoss Enterprise Application Platform 7 core Red Hat JBoss Enterprise Application Platform 8 core Red Hat JBoss Enterprise Application Platform Expansion Pack core Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-mlflow-rhel9, +3 more Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9, openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9, openshift5/ose-agent-installer-ui-rhel9 Red Hat OpenShift Dev Spaces devspaces/openvsx-rhel9, devspaces/dashboard-rhel9 Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Quay 3 quay/quay-rhel8 Red Hat Satellite 6 nodejs-babel-core, nodejs-theforeman-builder, satellite/iop-advisor-frontend-rhel9, satellite/iop-vulnerability-frontend-rhel9, satellite/iop-host-inventory-frontend-rhel9 Red Hat Single Sign-On 7 core Red Hat Trusted Artifact Signer rhtas/rekor-search-ui-rhel9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
NVD 3.1 3.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
GitHub 3.1 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm @babel/core
>=8.0.0-alpha.0, <8.0.0-rc.6
<7.29.6
8.0.0-rc.6
7.29.6

Affected products

  • babel babel

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.