StackRadar

CVE-2026-49356

Low

Advisory

Published 15 Jun 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
3.2
base score, highest
EPSS
0.001
3rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
184
of 17,781 indexed, latest versions
Container images
184
deployed by those charts
Fix available
1 of 1
affected package

@babel/core: Arbitrary File Read via sourceMappingURL Comment

Carried by container images the latest versions of 184 of 17,781 indexed charts deploy, on 184 images.

Affected packageAffected versionsFixed inImages
@babel/corenpm7.1.0, 7.1.2, 7.5.5, 7.7.2+69 more7.29.6184
OSV records
GHSA-4x5r-pxfx-6jf8

Charts affected

184 by stars
ChartLatestAffected imagesRadar Score
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
@babel/core@7.25.2
7.29.6

Open the chart page →

5,497
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
@babel/core@7.29.0
7.29.6

Open the chart page →

1,991
dashysergiotocaliniVerified publisher1.0.01 of 1See more

dashy sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
@babel/core@7.18.2
7.29.6

Open the chart page →

3,143
parkingsikalabs0.1.01 of 1See more

parking sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
ondrejsika/parking:latestb1fd497416c8
@babel/core@7.7.2
7.29.6

Open the chart page →

3,696
sneakerssneakers1.0.01 of 4See more

sneakers sneakers 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
helga09/shoes_ukr:v1.1.17999bc8b77c0
@babel/core@7.21.8
7.29.6

Open the chart page →

7,574
speedtest-trackersoblivionscall3.0.41 of 1See more

speedtest-tracker soblivionscall 3.0.4

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
henrywhitaker3/speedtest-tracker:latest47159a940229
@babel/core@7.12.3
7.29.6

Open the chart page →

2,460
pwssoketi0.2.41 of 1See more

pws soketi 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
quay.io/soketi/pws:0.8-16-alpine399d2e6b10ef
@babel/core@7.15.5
7.29.6

Open the chart page →

3,228
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e12 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
@babel/core@7.23.2
7.29.6

Open the chart page →

16,368
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb2 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
@babel/core@7.23.2
7.29.6

Open the chart page →

16,400
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f82 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
@babel/core@7.23.2
7.29.6

Open the chart page →

14,679
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091142 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
@babel/core@7.23.2
7.29.6

Open the chart page →

16,400
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4692 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d4694bd113093583
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
@babel/core@7.23.2
7.29.6

Open the chart page →

14,221
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3412 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.12-branch.testing3.88744-f55b3414bd113093583
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
@babel/core@7.23.2
7.29.6

Open the chart page →

14,221
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b22 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
@babel/core@7.23.2
7.29.6

Open the chart page →

16,019
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef2 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
@babel/core@7.23.2
7.29.6

Open the chart page →

15,635
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
@babel/core@7.28.3
7.29.6

Open the chart page →

11,100
retail-store-sample-checkout-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
@babel/core@7.27.7
7.29.6

Open the chart page →

1,313
nordmart-reviewstakaterVerified publisher0.0.61 of 3See more

nordmart-review stakater 0.0.6

1 of the 3 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
stakater/stakater-nordmart-review-ui:1.0.143f4926eedc74
@babel/core@7.14.3
7.29.6

Open the chart page →

11,554
nordmart-review-instancestakaterVerified publisher1.0.01 of 3See more

nordmart-review-instance stakater 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
stakater/stakater-nordmart-review-ui:1.0.143f4926eedc74
@babel/core@7.14.3
7.29.6

Open the chart page →

11,554
fdi-dotstatsuite-dlmstatcan0.3.11 of 1See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
@babel/core@7.14.6
7.29.6

Open the chart page →

3,881
fdi-dotstatsuite-sfs-solrstatcan1.0.21 of 4See more

fdi-dotstatsuite-sfs-solr statcan 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
@babel/core@7.29.0
7.29.6

Open the chart page →

6,065
fdi-dotstatsuite-sfs-solr-statefulstatcan1.0.21 of 2See more

fdi-dotstatsuite-sfs-solr-stateful statcan 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
@babel/core@7.29.0
7.29.6

Open the chart page →

919
strapistrapi-xmv0.1.11 of 1See more

strapi strapi-xmv 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
@babel/core@7.29.0
7.29.6

Open the chart page →

676
slack-emoji-makersuminhong0.1.01 of 1See more

slack-emoji-maker suminhong 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
honglab/slack-emoji-maker:v0.0.1ca075a926fe1
@babel/core@7.26.10
7.29.6

Open the chart page →

1,653
tensorzerotensorzero2026.6.01 of 2See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
tensorzero/ui:2026.6.0f2563d54724e
@babel/core@7.29.0
7.29.6

Open the chart page →

3,972
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
samajh/alprfrontend:latest05ef4fddbb75
@babel/core@7.12.3
7.29.6

Open the chart page →

20,270
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
pysga1996/python-redis-web:latestfdeec30ad482
@babel/core@7.12.16
7.29.6

Open the chart page →

4,661
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
vcnngr/pnbackend:latesteaf44ad0ad1f
@babel/core@7.28.0
7.29.6

Open the chart page →

4,768
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
@babel/core@7.14.6
7.29.6

Open the chart page →

3,129
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
@babel/core@7.26.10
7.29.6

Open the chart page →

5,984
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
@babel/core@7.12.10
7.29.6

Open the chart page →

10,127
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
@babel/core@7.11.4
7.29.6

Open the chart page →

22,665
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
@babel/core@7.29.0
7.29.6

Open the chart page →

5,459
workadventureworkadventure1.1.02 of 9See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
@babel/core@7.20.7
7.29.6
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
@babel/core@7.20.7
7.29.6

Open the chart page →

16,083

Container images carrying it

184 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
@babel/core@7.1.2
7.29.6
1
fosrl/pangolin:1.13.0c32ad797ab96
@babel/core@7.26.10
7.29.6
1
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
@babel/core@7.21.4
7.29.6
1
helga09/shoes_ukr:v1.1.17999bc8b77c0
@babel/core@7.21.8
7.29.6
1
henrywhitaker3/speedtest-tracker:latest47159a940229
@babel/core@7.12.3
7.29.6
1
heywood8/redisinsight:2.28.00bc9ab313d37
@babel/core@7.21.4
7.29.6
1
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
@babel/core@7.16.7
7.29.6
1
honglab/slack-emoji-maker:v0.0.1ca075a926fe1
@babel/core@7.26.10
7.29.6
1
joplin/server:3.0-beta52af57880c0e
@babel/core@7.22.5
7.29.6
1
joplin/server:2.14.2-betab87564ef34e9
@babel/core@7.22.5
7.29.6
1
junktext/getting-started:1.0.5a70936c04aed
@babel/core@7.15.8
7.29.6
1
junktext/getting-started:1.0.34d44adf5a4da2
@babel/core@7.15.8
7.29.6
1
jupyterhub/jupyterhub:5.4.63974ba945e65
@babel/core@7.20.12
7.29.6
1
keyoxide/keyoxide:stable96f27a71269d
@babel/core@7.17.7
7.29.6
1
kitware/cdash:v5.3.0d7767d9b9da4
@babel/core@7.23.3
7.29.6
1
kobotoolbox/kpi:2.022.24dbcacc01bccd4
@babel/core@7.17.9
7.29.6
1
kyleslugg/klusterview:latestba8c36dfdfbd
@babel/core@7.22.5
7.29.6
1
kyso/kyso-front:lateste52595c5c16f
@babel/core@7.23.0
7.29.6
1
laly9999/node-app:1dd0e503913e1
@babel/core@7.27.3
7.29.6
1
lavandadelpatio/frontend:latest501c3f31e0bc
@babel/core@7.9.6
7.29.6
1
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
@babel/core@7.25.2
7.29.6
1
library/mongo-express:1.0.2-20-alpine3.191aae00775251
@babel/core@7.19.6
7.29.6
1
linuxserver/calibre:version-v5.21.0a847b5b2d860
@babel/core@7.14.5
7.29.6
1
linuxserver/overseerr:1.35.06108ed066d4a
@babel/core@7.20.7
7.29.6
1
lissy93/dashy:2.0.51991f7be5ed0
@babel/core@7.17.0
7.29.6
1
mautic/mautic:7-apacheeb8cc73d97e1
@babel/core@7.28.6
7.29.6
1
mintproject/ensemble-manager:d5656dbc01623e291564d2894c72f0e7cb2408f4222e3b941a36
@babel/core@7.27.4
7.29.6
1
misskey/misskey:12.110.1e08b7c478093
@babel/core@7.11.4
7.29.6
1
mitchxxx/amazon:214e72480ec63a
@babel/core@7.21.4
7.29.6
1
moreillon/api-proxy:2373c1953739ef6956b5
@babel/core@7.21.0
7.29.6
1
moreillon/api-proxy:latestd7d4a5463525
@babel/core@7.21.0
7.29.6
1
moreillon/face-recognition-fastapi-front:latestc1072f4ab6aa
@babel/core@7.18.2
7.29.6
1
moreillon/food-manager:lateste8fd856e593d
@babel/core@7.25.2
7.29.6
1
moreillon/group-manager:latest3caa8f710ee0
@babel/core@7.25.2
7.29.6
1
moreillon/user-manager-mongoose:v5.0.1d2ee0423b797
@babel/core@7.23.5
7.29.6
1
mozilla/sentencecollector:2.0.91da6ff5c4895
@babel/core@7.10.5
7.29.6
1
nightscout/cgm-remote-monitor:14.2.500c3b4833f1b
@babel/core@7.11.4
7.29.6
1
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
@babel/core@7.20.12
7.29.6
1
nightscout/cgm-remote-monitor:15.0.3f604dc4c03ca
@babel/core@7.20.12
7.29.6
1
nocodb/nocodb:0.301.5d9516f0bf546
@babel/core@7.29.0
7.29.6
1
obolnetwork/charon-dkg-sidecar:maine263be0a7440
@babel/core@7.28.5
7.29.6
1
ondrejsika/parking:latestb1fd497416c8
@babel/core@7.7.2
7.29.6
1
ooghenekaro/amazon:latest03394ba1d6d8
@babel/core@7.21.4
7.29.6
1
openbas/caldera-server:5.1.0a277796d9724
@babel/core@7.18.2
7.29.6
1
openhab/openhab-cloud:a8138a329dd2bac8c4b
@babel/core@7.19.3
7.29.6
1
oryd/kratos-selfservice-ui-node:v0.13.0-20d454c21c11bc
@babel/core@7.17.8
7.29.6
1
outlinewiki/outline:0.82.0494dfb9249a6
@babel/core@7.26.7
7.29.6
1
pysga1996/python-redis-web:latestfdeec30ad482
@babel/core@7.12.16
7.29.6
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
@babel/core@7.26.8
7.29.6
1
requarks/wiki:canary-2.5.2438b5865a7386c
@babel/core@7.15.8
7.29.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.