Executive brief
@babel/core is a widely-used JavaScript compiler that developers rely on to transform modern code into compatible formats. A flaw in how it processes source map references allows an attacker who controls the input code to read arbitrary source map files from a developer's machine, potentially exposing sensitive path information and build artifacts. This risk applies only when compiling untrusted code; projects that build only trusted code are unaffected.
Technical details
The vulnerability exists in how @babel/core processes the sourceMappingURL comment in compiled code. An attacker controlling input source code can craft a malicious sourceMappingURL that references any file path on the system. When Babel compiles this code and processes source maps, it will attempt to read the referenced file. Combined with the ability to read the compiled output, an attacker can exfiltrate arbitrary files the Babel process has access to—provided they know the exact file path. The issue affects versions before 7.29.6 and 8.0.0-rc.6. Root cause involves insufficient validation of source map paths (CWE-22 path traversal, CWE-200 information exposure). Mitigation is available by setting inputSourceMap: false in Babel configuration or manually validating source map paths before compilation.
Affected products
- Babel @babel/core < 7.29.6 and 8.0.0-alpha.0 through 8.0.0-rc.5
Timeline
- 2026-06-15: disclosed
- 2026-06-15: patched: Patches released in @babel/core 7.29.6 and 8.0.0-rc.6