Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-49356

Опубликовано: 22 июн. 2026
Источник: nvd
CVSS3: 3.2
CVSS3: 3.6
EPSS Низкий

Описание

Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:babel:babel:*:*:*:*:*:*:*:*
Версия до 7.29.6 (исключая)
cpe:2.3:a:babel:babel:8.0.0:alpha0:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha10:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha11:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha12:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha13:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha14:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha15:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha16:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha17:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha3:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha4:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha5:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha6:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha7:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha8:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:alpha9:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:beta0:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:beta4:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:rc4:*:*:*:*:*:*
cpe:2.3:a:babel:babel:8.0.0:rc5:*:*:*:*:*:*

EPSS

Процентиль: 3%
0.00126
Низкий

3.2 Low

CVSS3

3.6 Low

CVSS3

Дефекты

CWE-22

Связанные уязвимости

ubuntu логотип

CVE-2026-49356

CVSS3: 3.2
ubuntu
около 1 месяца назад

Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.

redhat логотип

CVE-2026-49356

CVSS3: 3.6
redhat
около 1 месяца назад

Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.

msrc логотип

CVE-2026-49356

msrc
около 1 месяца назад

Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core

debian логотип

CVE-2026-49356

CVSS3: 3.2
debian
около 1 месяца назад

Babel is a compiler for writing next generation JavaScript. Prior to 8 ...

github логотип

GHSA-4x5r-pxfx-6jf8

CVSS3: 3.2
github
около 2 месяцев назад

@babel/core: Arbitrary File Read via sourceMappingURL Comment

EPSS

Процентиль: 3%
0.00126
Низкий

3.2 Low

CVSS3

3.6 Low

CVSS3

Дефекты

CWE-22