Npm · @Babel/Core · CVE-2026-49356
**Name of the Vulnerable Software and Affected Versions**
@babel/core versions prior to 7.29.6
@babel/core versions prior to 8.0.0-rc.6
**Description**
Compiling maliciously crafted code using `@babel/core` can allow an attacker to read any source map from the system. This occurs when the attacker controls the input source code, can read the output source code, and knows the path of the target source map file.
**Recommendations**
Update to version 7.29.6 or later.
Update to version 8.0.0-rc.6 or later.
Set `inputSourceMap` to `false` in the Babel options.
Manually extract the `#sourceMappingURL` comment from the input source code to validate if the linked source map is allowed to be read, passing an object to `inputSourceMap` only if validated, otherwise passing `false`.