CVE-2026-49356

Name	CVE-2026-49356
Description	Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1140816

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-babel7 (PTS)	bullseye (security), bullseye	7.12.12+~cs150.141.84-6+deb11u1	vulnerable
	bookworm	7.20.15+ds1+~cs214.269.168-3+deb12u2	vulnerable
	bookworm (security)	7.20.15+ds1+~cs214.269.168-3+deb12u1	vulnerable
	trixie	7.20.15+ds1+~cs214.269.168-8	vulnerable
	forky, sid	7.20.15+ds1+~cs214.269.168-17	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-babel7	source	(unstable)	(unfixed)			1140816

[trixie] - node-babel7 <no-dsa> (Minor issue)
https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8