Description
Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:
- the attacker controls the input source code
- the attacker can read the output source code
- the attacker knows the path of the source map file that they want to read
**Us
Recommendation
Update the @babel/core package to the latest compatible version. Followings are version details:
Affected version(s): **<= 7.29.0 >= 8.0.0-alpha.0, < 8.0.0-rc.5** Patched version(s): **7.29.6 8.0.0-rc.6**
References
Could your website be exposed too?
SmartScanner can check your website for @babel/core: Arbitrary File Read via sourceMappingURL Comment and gives you actionable findings to investigate.
Start a free scanRelated Issues
- PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments - CVE-2026-45623
- Prompty: Arbitrary file read via file reference expansion - CVE-2026-53598
- LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read - CVE-2026-39859
- Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
You might also like:
See something that needs correcting? Let us knowUpdated July 15, 2026