Is CVE-2026-49356 actively exploited?

No active exploitation of CVE-2026-49356 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-49356 be exploited remotely?

No. CVE-2026-49356 requires local access to exploit.

What is the CVSS score of CVE-2026-49356?

CVE-2026-49356 has a CVSS score of 3.6 (LOW).

HOME VULNERABILITIESCVE-2026-49356

LOW

CVE-2026-49356

CWE-22Published: June 22, 2026· Updated: Jun 26, 2026

3.6

CVSS v3.1

EPSS:0.11%probability of exploitation in 30 daysPercentile:1.8th

Official Description

Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.

NVD Source

Technical Analysis

CVE-2026-49356 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.