Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the @babel/core package, specifically within the source map handling logic. When compiling code, Babel processes sourceMappingURL comments to link transformed code back to its original source. The vulnerability, identified as GHSA-4x5r-pxfx-6jf8, is a path traversal issue that allows an attacker to read arbitrary files from the system running the Babel compiler.
My analysis of the security patches revealed the root cause. The vulnerable function is normalizeFile located in packages/babel-core/src/transformation/normalize-file.ts. In the vulnerable versions, this function would read a sourceMappingURL comment from the input code, resolve the path specified in it, and read the file using fs.readFileSync. The path was not properly sanitized, allowing directory traversal sequences (like ../). An attacker could craft a malicious sourceMappingURL comment pointing to a sensitive file on the filesystem. When Babel compiled this code, it would read the targeted file and include its contents in the output source map, which the attacker could then access.
The patch mitigates this by introducing a new function, readInputSourceMapFile, which is called by normalizeFile. This new function contains logic to validate the source map path. It ensures that the path resolves to a location within the project's root or the package's directory, effectively preventing traversal outside of the intended scope. Any attempt to access a file outside these boundaries is blocked.
Therefore, any runtime profile or stack trace generated during the exploitation of this vulnerability would point to the normalizeFile function, as it is the entry point for processing the malicious input that leads to the arbitrary file read.
normalizeFilepackages/babel-core/src/transformation/normalize-file.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @babel/core | npm | >= 8.0.0-alpha.0, < 8.0.0-rc.5 | 8.0.0-rc.6 |
| @babel/core | npm | <= 7.29.0 | 7.29.6 |