{"items":[{"id":"NVI-00017848","kind":"vulnerability","title":"@babel/core: Arbitrary File Read via sourceMappingURL Comment","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-4x5r-pxfx-6jf8","CVE-2026-49356"],"plain_summary":"GitHub lists this reviewed advisory for @babel/core, @babel/core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-73bd3f9323c393793018d6e3c6f6971a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-15T22:05:27.000Z","value":"3.2 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-73bd3f9323c393793018d6e3c6f6971a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-73bd3f9323c393793018d6e3c6f6971a","url":"https://github.com/advisories/GHSA-4x5r-pxfx-6jf8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-4x5r-pxfx-6jf8","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T09:59:43.724Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-73bd3f9323c393793018d6e3c6f6971a"],"technology":"@babel/core","known_exclusions":[],"conditions_summary":"## Impact\n\nUsing `@babel/core` to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are _all_ true:\n- the attacker controls the input source code\n- the attacker can read the output source code\n- the attacker knows the path of the source map file that they want to read\n\n**Users that only compile trusted code are not impacted.**\n\n## Patches\n\nThe vulnerability has been fixed in `@babel/core@7.29.6` and `@babel/core@8.0.0-rc.6`.\n\n## Workarounds\n\nCallers can mitigate the issue without upgrading by setting `inputSourceMap: false` in their Babel options.\n\nCallers can also manually extract the `#sourceMappingURL` comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to `inputSourceMap` (passing `false` when it's not).\n\n## Credits\n\nThanks Teodor-Cristian Radoi for reporting the vulnerability.","public_affected_ranges":[">= 8.0.0-alpha.0, < 8.0.0-rc.5"]},{"certainty":"source_listed","source_ids":["sr-73bd3f9323c393793018d6e3c6f6971a"],"technology":"@babel/core","known_exclusions":[],"conditions_summary":"## Impact\n\nUsing `@babel/core` to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are _all_ true:\n- the attacker controls the input source code\n- the attacker can read the output source code\n- the attacker knows the path of the source map file that they want to read\n\n**Users that only compile trusted code are not impacted.**\n\n## Patches\n\nThe vulnerability has been fixed in `@babel/core@7.29.6` and `@babel/core@8.0.0-rc.6`.\n\n## Workarounds\n\nCallers can mitigate the issue without upgrading by setting `inputSourceMap: false` in their Babel options.\n\nCallers can also manually extract the `#sourceMappingURL` comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to `inputSourceMap` (passing `false` when it's not).\n\n## Credits\n\nThanks Teodor-Cristian Radoi for reporting the vulnerability.","public_affected_ranges":["<= 7.29.0"]}],"null_published_at":"2026-11-05T19:10:21.475Z","source_updated_at":"2026-07-15T22:05:27.000Z","source_disclosed_at":"2026-06-15T17:14:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T09:59:43.724Z"}],"next_cursor":null,"snapshot_revision":"42594"}