CVE-2026-49356: Babel Compiler Information Disclosure Flaw

CVE-2026-49356 Overview

CVE-2026-49356 is a path traversal vulnerability [CWE-22] in @babel/core, the core compiler package for Babel, a widely deployed JavaScript transpiler. Versions prior to 8.0.0-rc.6 and 7.29.6 process sourceMappingURL comments in input source code without sufficient restrictions. An attacker who controls the input source code, can read the compiled output, and knows the path of a target source map file can use Babel to read arbitrary source map files from the host system. The vulnerability requires local access and high attack complexity, which limits its practical exploitability.

Critical Impact
Arbitrary file read of source map files on systems running Babel when the attacker controls input source code and observes compiled output.

Affected Products

@babel/core versions prior to 7.29.6 (7.x release line)
@babel/core versions prior to 8.0.0-rc.6 (8.x pre-release line)
Build pipelines and toolchains that invoke Babel on untrusted input source code

Discovery Timeline

2026-06-22 - CVE-2026-49356 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49356

Vulnerability Analysis

The flaw resides in how @babel/core resolves sourceMappingURL comment directives during compilation. Babel reads the path specified in the //# sourceMappingURL=... annotation and loads the referenced file to incorporate source map data into compilation output. The compiler does not constrain the referenced path to a safe base directory, allowing relative traversal sequences or absolute paths.

When Babel processes the malicious input, it reads the targeted file and embeds its contents into the generated output. An attacker reading the output recovers the contents of the file Babel was tricked into loading. The vulnerability is scoped to source map files because Babel only attempts to parse the referenced path as a source map, but any file at a known path on the local file system is reachable through this mechanism.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Babel trusts the sourceMappingURL value supplied by the input source code instead of validating that the resolved path lies within an expected source map directory.

Attack Vector

Exploitation requires three conditions: the attacker must supply input source code to a Babel compilation run, the attacker must observe the resulting compiled output, and the attacker must know the absolute or relative path of the source map file they wish to exfiltrate. A typical scenario is a multi-tenant build service or continuous integration pipeline that accepts user-submitted JavaScript and returns the transpiled result. The attacker submits code containing a crafted //# sourceMappingURL=/path/to/target.map directive, and Babel returns the file contents within the build output.

No verified public exploit code is available. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-4x5r-pxfx-6jf8.

Detection Methods for CVE-2026-49356

Indicators of Compromise

Input JavaScript files submitted to build systems that contain //# sourceMappingURL= comments referencing absolute paths or paths containing ../ traversal sequences.
Babel build output that embeds source map data referencing files outside the project source tree.
Unexpected file read operations from node processes executing @babel/core targeting paths outside the project working directory.

Detection Strategies

Scan source code submitted to shared build infrastructure for sourceMappingURL annotations that resolve outside the project root before invoking Babel.
Audit @babel/core package versions across CI runners and developer workstations to identify hosts running versions earlier than 7.29.6 or 8.0.0-rc.6.
Monitor process file access telemetry on build servers for node processes opening .map files outside expected project directories.

Monitoring Recommendations

Log all file read operations performed by Babel compilation jobs in multi-tenant build environments and alert on paths outside the build workspace.
Track package dependency manifests in source control to detect downgrade of @babel/core to vulnerable versions.
Correlate build job inputs with output artifact contents to identify cases where build output contains unexpected file system data.

How to Mitigate CVE-2026-49356

Immediate Actions Required

Upgrade @babel/core to 7.29.6 for the 7.x release line or 8.0.0-rc.6 for the 8.x pre-release line.
Audit any service that compiles attacker-supplied JavaScript with Babel and treat it as a higher-risk asset until patched.
Restrict file system permissions of build service accounts to the minimum required to compile project sources.

Patch Information

The maintainers fixed the vulnerability in @babel/core7.29.6 and 8.0.0-rc.6. Update package manifests with npm install @babel/core@^7.29.6 for production deployments, or pin to the corresponding 8.x pre-release where applicable. Refer to the GitHub Security Advisory GHSA-4x5r-pxfx-6jf8 for full remediation guidance.

Workarounds

Strip or reject sourceMappingURL comments from untrusted input source code before passing it to Babel.
Run Babel inside a sandbox or container with a read-only file system view limited to the project source directory.
Disable source map processing in Babel configuration when compiling code from untrusted sources by setting sourceMaps: false in the Babel options.

bash

# Configuration example
npm install @babel/core@^7.29.6
npm ls @babel/core