CVE-2026-49356

Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.

• CWE-22
• CWE-200

• https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8Mitigation, Vendor Advisory

Published

Jun 22, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49347Quest Bot is an opensource Discord Bot. Prior to version 1.1…5.3
• CVE-2026-49349regclient is a Docker and OCI Registry Client in Go. Prior t…6.8
• CVE-2026-4935The OttoKit: All-in-One Automation Platform WordPress plugin…8.6
• CVE-2026-493529Router is an AI router & token saver. From 0.2.21 until 0.4…9.8
• CVE-2026-493539Router is an AI router & token saver. In 0.4.45 and earlier…7.5
• CVE-2026-49355OpenProject is open-source, web-based project management sof…4.3
• CVE-2026-49357Line Desktop MCP is a project that, while unaffiliated with …8.8
• CVE-2026-49358PhpWeasyPrint is a PHP library allowing PDF generation from …3
• CVE-2026-49359PhpWeasyPrint is a PHP library allowing PDF generation from …6.5
• CVE-2026-49361Apache Fluss versions prior to 0.9.1 configure the Netty Len…7.5
• CVE-2026-49365Generation of Error Message Containing Sensitive Information…5.3
• CVE-2026-49366In JetBrains IntelliJ IDEA before 2026.1.1 command injection…7.8