Packages / @babel/core / Security

LowVulnerabilityGHSA-4x5r-pxfx-6jf8CVE-2026-49356Published 15 Jun 2026

@babel/core: Arbitrary File Read via sourceMappingURL Comment

Affected releases · @babel/core

  • 7.x7.0.0 – 7.29.0Fixed in 7.29.6

On 7.x, the newest line:

npm install @babel/core@7.29.6
8.x

  1. Not affected

    8.0.0 – 8.0.7

    5 releases, latest

7.x

  1. Affected

    7.0.0 – 7.29.0

    157 releases

  2. Fixed

    7.29.6 – 7.29.7

    2 releases

164 stable releases of @babel/core, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @babel/core. It is read in your browser and sent nowhere.

What happens

Impact

Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:

  • the attacker controls the input source code

  • the attacker can read the output source code

  • the attacker knows the path of the source map file that they want to read

Users that only compile trusted code are not impacted.

Patches

The vulnerability has been fixed in @babel/core@7.29.6 and @babel/core@8.0.0-rc.6.

Workarounds

Callers can mitigate the issue without upgrading by setting inputSourceMap: false in their Babel options.

Callers can also manually extract the #sourceMappingURL comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to inputSourceMap (passing false when it's not).

Credits

Thanks Teodor-Cristian Radoi for reporting the vulnerability.