CVE-2026-49356

About vulnerability

Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.

Affected product:

0 , @alifd/meet-react , @graphql-cli/common , @pnpm/read-package-json , @redocly/config , @theme-ui/style-guide , @web3auth/ws-embed , AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , Angular , AngularJS , Babel , Bootstrap , CentOS 7 ELS , EndemolShineGroup/cosmiconfig-typescript-loader , MetaMask/core , Next.js , Node.js , React , TanStack/router , TanStack/table , TuxCare 9.6 ESU , Vue , adobe-react-spectrum , aes-decrypter , ag-charts , ag-grid , ai-sdk-vue , alibaba/hooks , alifd-next , align , allure-js , amplify-js , antfu-design , anthropic-ai-sdk , anthropic-ai-vertex-sdk , apidom , apollo , apollo-codegen-flow , apollo-codegen-scala , apollo-language-server , apollo-server , apollo-tooling , apollo-upload-client , appium , appium-eslint-config-appium-ts , apply-release-plan , arco-design , aria-query , assetgraph , assistant-ui , assistant-ui-react-markdown , ast-kit , ast-walker-scope , astro , astrojs-cloudflare , astrojs-node , astrojs-react , astrojs-tailwind , async-storage , augment-vir-assert , auth , awesome-ajv-errors , awesome-code-frame , axios-retry , b4a , babel-dead-code-elimination , babel-debug-macros , babel-eslint , babel-loader , babel-merge , babel-plugin-bundled-import-meta , babel-plugin-import , babel-plugin-istanbul , babel-plugin-jest-hoist , babel-plugin-jsx , babel-plugin-jsx-dom-expressions , babel-plugin-macros , babel-plugin-polyfill-es-shims , babel-plugin-proposal-private-property-in-object , babel-plugin-react-compiler , babel-plugin-styled-components , babel-plugin-transform-hook-names , babel-plugin-transform-typescript-metadata , babel-plugin-transform-vue-jsx , babel-polyfills , babel-preset-current-node-syntax , babel-preset-fbjs , babel-sugar-v-model , babel-sugar-v-on , babel-walk , babelify , bare-fs , bare-stream , base-ui , berry , better-ajv-errors , broadcast-channel , broccoli-babel-transpiler , broker-factory , build , c12 , canvg , changesets , changesets-release-utils , changesets-write , chromatic-com-storybook , chromatic-e2e , codeceptjs , codeshift-core , commit-analyzer , commitlint , config-inspector , config-plugins , configure , connect-es , connected-react-router , consolidate.js , constantinople , controllers , conventional-changelog , conventional-changelog-core , conventional-commits-parser , conventional-recommended-bump , core , cosmiconfig , cosmiconfig-typescript-loader , create-expo-module , create-react-app , create-wdio , csf-mdx1 , css-vendor , cucumber-js , customauth , data-driven-forms-react-form-renderer , datadog-ci , date-fns , db0 , dcmjs , dcmjs-codecs , dcmjs-dimse , decap-cms , decap-cms-widget-file , decap-cms-widget-select , definitelytyped , dependency-check , dependents-detective-less , detective-amd , detective-cjs , detective-es6 , detective-less , detective-sass , detective-scss , detective-typescript , detective-vue2 , devtools , diegomura-react-pdf , diegomura/react-pdf , dnd-core , documentation , docusaurus , docusaurus-babel , docusaurus-bundler , docusaurus-core , docusaurus-mdx-loader , docusaurus-module-type-aliases , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-search-algolia , docusaurus-types , docusaurus-utils , docusaurus-utils-common , docusaurus-utils-validation , dom-helpers , dom-testing-library , dotansimha-graphql-yoga , drizzle-orm , dxup-nuxt , edge-runtime , editor , elements , ember-auto-import , ember-cli , ember-cli-babel , ember-cli-typescript , ember-compatibility-helpers , embroider , emotion , emotion-babel-plugin-jsx-pragmatic , emotion-css , emotion-react , esbuild-plugin-babel , esbuild-plugin-vue3 , eslint , eslint-config-ipfs , eslint-config-love , eslint-config-react-app , eslint-config-standard , eslint-etc , eslint-loader , eslint-plugin-es , eslint-plugin-etc , eslint-plugin-flowtype , eslint-plugin-formatjs , eslint-plugin-ft-flow , eslint-plugin-graphql , eslint-plugin-import , eslint-plugin-jest-dom , eslint-plugin-jsdoc , eslint-plugin-jsx-a11y , eslint-plugin-node , eslint-plugin-promise , eslint-plugin-react , eslint-plugin-unicorn , eslint-utils , estree-to-babel , eth-block-tracker , eth-method-registry , ethjs-contract , ethjs-filter , ethjs-format , ethjs-query , ethjs-rpc , ethjs-unit , ethjs-util , expect , expect-webdriverio , expo , expo-application , expo-camera , expo-cli , expo-device , expo-file-system , expo-glass-effect , expo-json-file , expo-localization , expo-manifests , expo-module-scripts , expo-modules-autolinking , expo-package-manager , expo-updates , expo-updates-interface , expo-vector-icons , ext-apps , facebook/metro , fast-unique-numbers , fcl-js , fetch-node-details , fets , ffjavascript , final-form , final-form-arrays , final-form-focus , floating-ui-vue , floating-vue , flow , fork-ts-checker-webpack-plugin , formatjs , formatjs-ts-transformer , fullstory-babel-plugin-react-native , garfish , gateway , gatsby , gatsby-page-utils , get-amd-module-type , git-authors-cli , github , glimmer.js , globe.gl , google-cloud-functions-framework , google-cloud-node , gp-js-client , graphql-code-generator , graphql-codegen-typescript-generic-sdk , graphql-codegen-typescript-graphql-request , graphql-codegen-typescript-jit-sdk , graphql-codegen-typescript-nhost , graphql-codegen-typescript-react-apollo , graphql-codegen-typescript-rtk-query , graphql-config , graphql-hive-gateway , graphql-hive-plugin-mcp , graphql-hive/console , graphql-hive/envelop , graphql-language-service-server , graphql-mesh , graphql-mesh-cli , graphql-mesh-compose-cli , graphql-mesh-config , graphql-mesh-migrate-config-cli , graphql-rate-limit , graphql-shield , graphql-toolkit , graphql-tools , graphql-tools-git-loader , graphql-tools-links , gutenberg , happy-dom , hcaptcha-react-hcaptcha , head , headlessui-vue , hermes , heroui , heroui-image , history , html2pdf.js , http-helpers , i18next , impound , inertiajs-vue3 , intl-tel-input , istanbuljs , istanbuljs-nyc-config-babel , jest , jest-chain-transform , jest-console , jest-dom , jest-phabricator , jest-preset-angular , jest-repl , jest-resolve , jest-specific-snapshot , jest-test-result , jest-vue-preprocessor , jest-watch-typeahead , jest-watcher , jimp , jimp-plugin-blur , jimp-plugin-circle , jimp-plugin-color , jimp-plugin-contain , jimp-plugin-cover , jimp-plugin-crop , jimp-plugin-displace , jimp-plugin-fisheye , jimp-plugin-mask , jimp-plugin-print , jimp-plugin-rotate , jovidecroock-prefresh , jscodeshift , jscodeshift-add-imports , jscodeshift-find-imports , jsdoc , json-future , json-render , json-schema-to-ts , jspdf , jss , jss-plugin-camel-case , jss-plugin-default-unit , jss-plugin-global , jss-plugin-nested , jss-plugin-props-sort , jss-plugin-rule-value-function , jss-plugin-vendor-prefixer , jsx-vue2 , karma-coverage-istanbul-reporter , koa-node-resolve , konan , lerna , lingui-babel-plugin-lingui-macro , lingui-cli , lingui-conf , lingui-core , lingui-format-po , lingui-vite-plugin , lit , lit-labs-testing , lit/lit , load-json-file , loadable-components , localforage-asyncstorage-driver , loopback , loopback-connector , loopback-connector-remote , loopback-datasource-juggler , loopback-phase , lottie-react-native , m3u8-parser , magic-js , magicast , magiclabs/magic-js , mantine , mantine-notifications , manypkg , masked-view , material-ui , mathjs , mdx , media-query-parser , meow , metadata-helpers , metamask-account-tree-controller , metamask-assets-controller , metamask-assets-controllers , metamask-bridge-controller , metamask-bridge-status-controller , metamask-chomp-api-service , metamask-claims-controller , metamask-client-utils , metamask-earn-controller , metamask-eip-5792-middleware , metamask-ens-controller , metamask-eth-snap-keyring , metamask-gator-permissions-controller , metamask-logging-controller , metamask-money-account-upgrade-controller , metamask-multichain-account-service , metamask-multichain-api-middleware , metamask-multichain-network-controller , metamask-multichain-transactions-controller , metamask-name-controller , metamask-network-enablement-controller , metamask-notification-services-controller , metamask-perps-controller , metamask-preferences-controller , metamask-profile-metrics-controller , metamask-ramps-controller , metamask-sample-controllers , metamask-sdk , metamask-shield-controller , metamask-signature-controller , metamask-smart-transactions-controller , metamask-snaps-cli , metamask-snaps-jest , metamask-snaps-rollup-plugin , metamask-snaps-simulation , metamask-snaps-webpack-plugin , metamask-social-controllers , metamask-subscription-controller , metamask-transaction-pay-controller , metamask-user-operation-controller , metro , metro-babel-register , microsoft-365-agents-toolkit , mobile-wallet-adapter , modern.js , module-definition , module-deps , module-federation-core , module-federation/core , mpd-parser , mqtt , mui-base , mui-internal-markdown , mui-material-nextjs , mui-private-theming , mui-styled-engine , mui-styled-engine-sc , mui-system , mui-types , mui-utils , mui-x , mui-x-charts-vendor , mui-x-telemetry , mui-x-virtualizer , mux.js , native-html-css-processor , native-html-transient-render-engine , netlify-build , netlify-build-info , netlify-cms , netlify-cms-app , netlify-cms-backend-azure , netlify-cms-backend-gitlab , netlify-cms-backend-proxy , netlify-cms-backend-test , netlify-cms-core , netlify-cms-ui-default , netlify-cms-widget-code , netlify-cms-widget-colorstring , netlify-cms-widget-date , netlify-cms-widget-datetime , netlify-cms-widget-list , netlify-cms-widget-map , netlify-cms-widget-markdown , netlify-cms-widget-object , netlify-cms-widget-relation , netlify-dev , netlify-edge-functions , netlify-functions-dev , netlify-functions-utils , netlify-nuxt , netlify-opentelemetry-sdk-setup , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , netlify/functions , netlify/netlify-cms , ng-packagr , nitro , noxcturnal , npm , npm-package-json-lint , npm:@metamask/polling-controller , npm:@metamask/sentinel-api-service , npm:@toruslabs/secure-pub-sub , npm:@toruslabs/starkware-crypto , npm:@web3auth/ethereum-provider , npm:netlify-cms-widget-image , npm:remark-mdxjs , nuxt , nuxt-cli , nyc , oas , oas-normalize , onflow-config , onflow-fcl , onflow-fcl-core , onflow-fcl-rainbowkit-adapter , onflow-fcl-react-native , onflow-fcl-wc , onflow-react-core , onflow-react-sdk , onflow-sdk , onflow-transport-http , onflow/fcl-js , op-sqlite , open-wc , open-wc-building-utils , open-wc-semantic-dom-diff , open-wc-testing-karma , open-wc-testing-karma-bs , opentui , oxc , parcel-bundler , parse-function , parse-json , pigment-css , pinia , pinia-colada , pkcs7 , plugins , pnpm , polished , portal-vue , porto , postcss-loader , posthog-react-native-plugin , pre , preact-preset-vite , precinct , prefresh , prefresh-babel-plugin , preset-modules , primitives , privy-io , pug , pug-code-gen , pug-plain-loader , puppeteer , query , radix-ui-primitives , radix-ui-react-avatar , radix-ui-react-focus-scope , radix-ui-react-portal , radix-ui-react-primitive , radix-ui-react-slot , radix-ui/primitives , radix-vue , rainbowkit , rax , rc-cascader , rc-checkbox , rc-collapse , rc-component-menu , rc-component-overflow , rc-component-tabs , rc-dialog , rc-drawer , rc-dropdown , rc-field-form , rc-image , rc-input , rc-input-number , rc-mentions , rc-menu , rc-motion , rc-overflow , rc-pagination , rc-picker , rc-resize-observer , rc-segmented , rc-select , rc-switch , rc-table , rc-tabs , rc-tree , rc-upload , rc-util , rc-virtual-list , re-notif , reach-dialog , reach-ui , read-package-up , read-pkg , read-pkg-up , readme-better-ajv-errors , readme-openapi-parser , reakit-playground , reakit/reakit , recharts , recyclerlistview , redocly-cli , redocly-client-generator , reduck , redux , redux-devtools-extension , redux-promise-middleware , redux-saga , redux-saga-core , redux-thunk , redux-toolkit , regenerator , regenerator-preset , rehype-cli , reka-ui , relay , release-notes-generator , releaser-tools , remark-cli , rematch , rematch-core , remix , restart-ui , ripple , rna , rollup-plugin-dts , rollup-plugin-terser , rollup-plugin-workbox , router , rsbuild , rsbuild-plugin-pug , rsdoctor , rsdoctor-core , rsdoctor-graph , rsdoctor-rspack-plugin , rsdoctor-sdk , rsdoctor-utils , rspress , runtime-cli , rushstack , rushstack-heft-node-rig , rushstack-heft-web-rig , rushstack-package-extractor , rxjs-report-usage , sanity , sanity-cli , sanity-cli-build , sanity-codegen , sanity-workbench-cli , scalar , scalar/scalar , semantic-release , semantic-release-changelog , semantic-release-git , sentry-browser , sentry-esbuild-plugin , sentry-javascript-bundler-plugins , sentry-vue , session-manager-web , sharp , shikijs-vitepress-twoslash , single-factor-auth , snaps , sofa-api , solana-embed , solana-web3.js , solid , solid-refresh , solid-vite-plugin , solidjs-start , spectrum-icons-ui , spectrum-icons-workflow , standard-version , storybook , storybook-addon-webpack5-compiler-swc , storybook-testing-library , streamx , strong-globalize , strong-remoting , styled-components , styled-jsx , stylelint , stylelint-no-unsupported-browser-features , stylelint-scss , subfont , suretype , svg2pdf.js , svgr , swagger-js , swrv , system-ui/theme-ui , tanstack-devtools-utils , tanstack-react-start , tanstack-react-start-rsc , tanstack-router , tanstack-router-cli , tanstack-router-generator , tanstack-router-plugin , tanstack-router-utils , tanstack-router-vite-plugin , tanstack-solid-start , tanstack-start-plugin-core , tanstack-table , tanstack-vue-store , tanstack-vue-virtual , tar-fs , tar-stream , teex , telemetry , testem , testing-library-cypress , testing-library-react , testing-library-react-hooks , text-decoder , textarea , theme-ui , three-render-objects , toprf-secure-backup , torus-embed , torus.js , toruslabs-constants , toruslabs-openlogin-jrpc , toruslabs-openlogin-utils , torusresearch/bs58 , trigger , tronwallet-adapter , tronweb , tronweb3-tronwallet-adapter-metamask-tron , ts-checker-rspack-plugin , ts-jest , tsd , tslint , tslint-consistent-codestyle , tsrx , twoslashes/twoslash , types-react-redux , typescript-eslint , uncontrollable , unhead , unified-args , unified-engine , unimport , universal-api , unplugin , unplugin-vue , unplugin-vue-router , unstorage , untyped , user-event , v-lazy-show , vanilla-extract , vanilla-extract-sprinkles , vee-validate , vercel , victory-native , video.js , videojs-http-streaming , videojs-vhs-utils , videojs-xhr , vinxi , virmator , vite , vite-dev-rpc , vite-hot-client , vite-plugin-checker , vite-plugin-glimmerx , vite-plugin-inspect , vite-plugin-istanbul , vite-plugin-react , vite-plugin-solid , vite-plugin-vue , vite-plugin-vue-inspector , vite-plugin-vue-tracer , vite-plus , vitefu , vitest , wagmi , wagmi-connectors , wallet-adapter , wallet-standard , walletconnect-monorepo , walletconnect-utils , wdio-cli , wdio-cucumber-framework , wdio-globals , wdio-local-runner , wdio-mocha-framework , wdio-runner , web , web-dev-server , web-dev-server-polyfill , web-dev-server-storybook , web-infra-dev/modern.js , web-mocks , web-polyfills-loader , web-storybook-builder , web-test-runner-browserstack , web-test-runner-playwright , web-test-runner-saucelabs , web3auth , web3auth-web , webassemblyjs-dce , webassemblyjs-wasm-text-gen , webdriverio , webpack-cli-generators , with , wordpress-babel-preset-default , wordpress-components , workbox , worker-factory , worker-timers , worker-timers-broker , worker-timers-worker , workerpool , wotan , wyw-in-js , x402 , yarnpkg-plugin-compat , yarnpkg-plugin-npm-cli , yarnpkg-plugin-pnp , yeoman-generator , yup , zalmoxisus/redux-devtools-extension , zephyr-packages

Affected packages:

vue @ 3.5.42 (+9760 more)