CVE-2026-49356

{"id": "CVE-2026-49356", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49356", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T17:22:57.466209Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.6, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "babel", "product": "babel", "versions": [{"status": "affected", "version": ">= 8.0.0-alpha.0, < 8.0.0-rc.5"}, {"status": "affected", "version": "< 7.29.6"}]}]}], "published": "2026-06-22T18:16:41.107", "references": [{"url": "https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6."}], "lastModified": "2026-06-26T20:04:23.897", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:babel:babel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CA3CCF0-1BB3-421B-A45D-8D3846B977B4", "versionEndExcluding": "7.29.6"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha0:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35F6AF6B-8CB6-40BB-B0AE-32E89718ED8C"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAFA4C96-CD2A-47A5-BA4E-134BA1D366B3"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAC310EC-C0CF-4D27-BA54-20B3207B4118"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80E37BB6-34C2-437B-A9DC-018B23F5E7BD"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B74C4261-EB8F-448D-AF41-CB82246C3EB4"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha13:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF7E80E5-B02B-481A-B928-748F4ED680BB"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha14:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED674570-F784-4DE5-9F47-5692AB00BC14"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha15:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E6B4629-E2BA-4ED2-AF0D-ADE873EE9727"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha16:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "207845B9-8380-4ED7-9AE8-F0C872BBCB7B"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha17:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2CEDA1E8-20C6-448F-8272-D19318FE8033"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD426CF6-E4B7-4F65-9968-A485F745E377"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "92CE9983-D67E-4DE6-B9EE-CCE55DF615E7"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66E5DE6B-CD6D-4687-AB1C-90B294DE8DCC"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E3BD45A-177D-4006-8820-EEABE6EF03FC"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9323EF4-77AA-410A-A2F7-D905C6175A64"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67E62B17-72F2-464F-AB14-E7A9F744AC01"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDC6F0F5-3141-41CD-B8D0-13AE9FF4FFEC"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:alpha9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC459C4A-04F3-4521-A7EA-A03A118AA4F0"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:beta0:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35A391E9-F191-47D1-9261-BDDDFF99DB6C"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A97F9D1-C700-419B-83AE-0FC781AA74EB"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEA9CFE5-8A05-4C9C-B2C2-E52FDE8748AE"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAA9BB4D-E826-4784-A336-E0C55B062D95"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:beta4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9915F12-E44D-4345-9597-371FC707E89D"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00B61EF2-BE57-4DBA-87FA-A73B7BA6C109"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E405A097-645D-4653-97AD-90F3D0A3F2BF"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5FFF6F2-3D4A-4E68-A93D-A03F106C0095"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95EB7702-7577-4926-8EC8-61C02EE3B95D"}, {"criteria": "cpe:2.3:a:babel:babel:8.0.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C0D1707-31BA-4EAF-9B23-9AFB26704BBF"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}