CVE-2026-49356

Name of the Vulnerable Software and Affected Versions @babel/core versions prior to 7.29.6 @babel/core versions prior to 8.0.0-rc.6

Description Compiling maliciously crafted code using @babel/core can allow an attacker to read any source map from the system. This occurs when the attacker controls the input source code, can read the output source code, and knows the path of the target source map file.

Recommendations Update to version 7.29.6 or later. Update to version 8.0.0-rc.6 or later. Set inputSourceMap to false in the Babel options. Manually extract the #sourceMappingURL comment from the input source code to validate if the linked source map is allowed to be read, passing an object to inputSourceMap only if validated, otherwise passing false.