CVE-2026-49356Low· 3.2▾ Sunlit@babel/core: Arbitrary File Read via sourceMappingURL Comment
▾ Sunlit zone — Low / medium · no exploitation signal
impact 17.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.1%
0.1% → 0.2%
Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true:
Users that only compile trusted code are not impacted.
The vulnerability has been fixed in @babel/[email protected] and @babel/[email protected].
Callers can mitigate the issue without upgrading by setting inputSourceMap: false in their Babel options.
Callers can also manually extract the #sourceMappingURL comment from the input source code, validate whether the source map that it links to is allowed to be read, and if it is pass an object to inputSourceMap (passing false when it's not).
Thanks Teodor-Cristian Radoi for reporting the vulnerability.
@babel/core >= 8.0.0-alpha.0, < 8.0.0-rc.5@babel/core <= 7.29.0Upgrade to a patched release:
@babel/core 8.0.0-rc.6@babel/core 7.29.6Connected by shared product, vendor, weakness, or advisory.
CVE-2021-3426Medium· 5.7There's a flaw in Python 3's pydoc
CVE-2025-11079Medium· 5.3A security flaw has been discovered in Campcodes Farm Management System 1.0
CVE-2021-41277Critical· 10.0Metabase is an open source data analytics platform
CVE-2022-31746Medium· 6.5Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header
CVE-2021-32822Medium· 4.0hbs: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor
CVE-2024-39896High· 7.5Directus Allows Single Sign-On User Enumeration