Read the docs
TI-2026-36529 Aliases CVE-2026-49356GHSA-4x5r-pxfx-6jf8

Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core

Priority LOW 16CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00152 4th percentileScored 2026-11-07
Fix Fixed babel (babel): 8.0.0-rc.5, 7.29.6@babel/core (npm): 8.0.0-rc.6, 7.29.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
babelbabel8.0.0-alpha.0 to before 8.0.0-rc.5; before 7.29.68.0.0-rc.5, 7.29.6Patch availableCNA
—@babel/core (npm)8.0.0-alpha.0 to before 8.0.0-rc.68.0.0-rc.6Patch availableGHSA-4x5r-pxfx-6jf8
—@babel/core (npm)before 7.29.67.29.6Patch availableGHSA-4x5r-pxfx-6jf8
  • babel Vendorbabel Affected 8.0.0-alpha.0 to before 8.0.0-rc.5; before 7.29.6 Fixed in 8.0.0-rc.5, 7.29.6 Patch available CNA
  • @babel/core (npm) Vendor— Affected 8.0.0-alpha.0 to before 8.0.0-rc.6 Fixed in 8.0.0-rc.6 Patch available GHSA-4x5r-pxfx-6jf8
  • @babel/core (npm) Vendor— Affected before 7.29.6 Fixed in 7.29.6 Patch available GHSA-4x5r-pxfx-6jf8

CPE configurations NVD · 29

CPEVersionsRoleVendor
cpe:2.3:a:babel:babel:*:*:*:*:*:*:*:*before 7.29.6Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha0:*:*:*:*:*:*8.0.0 alpha0Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha1:*:*:*:*:*:*8.0.0 alpha1Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha10:*:*:*:*:*:*8.0.0 alpha10Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha11:*:*:*:*:*:*8.0.0 alpha11Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha12:*:*:*:*:*:*8.0.0 alpha12Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha13:*:*:*:*:*:*8.0.0 alpha13Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha14:*:*:*:*:*:*8.0.0 alpha14Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha15:*:*:*:*:*:*8.0.0 alpha15Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha16:*:*:*:*:*:*8.0.0 alpha16Vulnerablebabel
  • cpe:2.3:a:babel:babel:*:*:*:*:*:*:*:* Versions before 7.29.6 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha0:*:*:*:*:*:* Versions 8.0.0 alpha0 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha1:*:*:*:*:*:* Versions 8.0.0 alpha1 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha10:*:*:*:*:*:* Versions 8.0.0 alpha10 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha11:*:*:*:*:*:* Versions 8.0.0 alpha11 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha12:*:*:*:*:*:* Versions 8.0.0 alpha12 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha13:*:*:*:*:*:* Versions 8.0.0 alpha13 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha14:*:*:*:*:*:* Versions 8.0.0 alpha14 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha15:*:*:*:*:*:* Versions 8.0.0 alpha15 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha16:*:*:*:*:*:* Versions 8.0.0 alpha16 Vulnerable ·babel
Show 19 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:babel:babel:8.0.0:alpha17:*:*:*:*:*:*8.0.0 alpha17Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha2:*:*:*:*:*:*8.0.0 alpha2Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha3:*:*:*:*:*:*8.0.0 alpha3Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha4:*:*:*:*:*:*8.0.0 alpha4Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha5:*:*:*:*:*:*8.0.0 alpha5Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha6:*:*:*:*:*:*8.0.0 alpha6Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha7:*:*:*:*:*:*8.0.0 alpha7Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha8:*:*:*:*:*:*8.0.0 alpha8Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:alpha9:*:*:*:*:*:*8.0.0 alpha9Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:beta0:*:*:*:*:*:*8.0.0 beta0Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:beta1:*:*:*:*:*:*8.0.0 beta1Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:beta2:*:*:*:*:*:*8.0.0 beta2Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:beta3:*:*:*:*:*:*8.0.0 beta3Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:beta4:*:*:*:*:*:*8.0.0 beta4Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:rc1:*:*:*:*:*:*8.0.0 rc1Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:rc2:*:*:*:*:*:*8.0.0 rc2Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:rc3:*:*:*:*:*:*8.0.0 rc3Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:rc4:*:*:*:*:*:*8.0.0 rc4Vulnerablebabel
cpe:2.3:a:babel:babel:8.0.0:rc5:*:*:*:*:*:*8.0.0 rc5Vulnerablebabel
  • cpe:2.3:a:babel:babel:8.0.0:alpha17:*:*:*:*:*:* Versions 8.0.0 alpha17 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha2:*:*:*:*:*:* Versions 8.0.0 alpha2 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha3:*:*:*:*:*:* Versions 8.0.0 alpha3 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha4:*:*:*:*:*:* Versions 8.0.0 alpha4 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha5:*:*:*:*:*:* Versions 8.0.0 alpha5 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha6:*:*:*:*:*:* Versions 8.0.0 alpha6 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha7:*:*:*:*:*:* Versions 8.0.0 alpha7 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha8:*:*:*:*:*:* Versions 8.0.0 alpha8 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:alpha9:*:*:*:*:*:* Versions 8.0.0 alpha9 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:beta0:*:*:*:*:*:* Versions 8.0.0 beta0 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:beta1:*:*:*:*:*:* Versions 8.0.0 beta1 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:beta2:*:*:*:*:*:* Versions 8.0.0 beta2 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:beta3:*:*:*:*:*:* Versions 8.0.0 beta3 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:beta4:*:*:*:*:*:* Versions 8.0.0 beta4 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:rc1:*:*:*:*:*:* Versions 8.0.0 rc1 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:rc2:*:*:*:*:*:* Versions 8.0.0 rc2 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:rc3:*:*:*:*:*:* Versions 8.0.0 rc3 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:rc4:*:*:*:*:*:* Versions 8.0.0 rc4 Vulnerable ·babel
  • cpe:2.3:a:babel:babel:8.0.0:rc5:*:*:*:*:*:* Versions 8.0.0 rc5 Vulnerable ·babel

Remediation

  • Fix · CNA babel (babel) Fixed in 8.0.0-rc.5, 7.29.6
  • Fix · GHSA-4x5r-pxfx-6jf8 @babel/core (npm) Fixed in 8.0.0-rc.6 Advisory →
  • Fix · GHSA-4x5r-pxfx-6jf8 @babel/core (npm) Fixed in 7.29.6 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 38 products
  • Cryostat 4
  • Gatekeeper 3
  • Migration Toolkit for Containers
  • Node HealthCheck Operator
  • OpenShift Pipelines
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Red Hat 3scale API Management Platform 2
  • Red Hat AMQ Broker 7
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Keycloak
  • Red Hat Build of Podman Desktop
  • Red Hat Ceph Storage 9
  • Red Hat Connectivity Link 1
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Fuse 7
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Virtualization 4
  • Red Hat Quay 3
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat Trusted Artifact Signer
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of Apache Camel for Spring Boot 4
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49356
  2. 2026-10-03 Alias added: GHSA-4x5r-pxfx-6jf8
  3. 2026-10-27 Affected versions changed · Red Hat
  4. 2026-10-30 Affected versions changed · Red Hat

References

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences