@babel/core: Arbitrary File Read via sourceMappingURL Comment

Description

Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:

• the attacker controls the input source code
• the attacker can read the output source code
• the attacker knows the path of the source map file that they want to read

**Us

Recommendation

Update the @babel/core package to the latest compatible version. Followings are version details:

• Affected version(s): **<= 7.29.0

  >= 8.0.0-alpha.0, < 8.0.0-rc.5**

• Patched version(s): **7.29.6

  8.0.0-rc.6**

References

• GHSA-4x5r-pxfx-6jf8
• babeljs.io
• CVE-2026-49356
• CWE-200
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments - CVE-2026-45623
• Prompty: Arbitrary file read via file reference expansion - CVE-2026-53598
• LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read - CVE-2026-39859
• Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@babel/core