StackRadar

CVE-2026-49356

Low

Advisory

Published 15 Jun 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
3.6
base score, highest
EPSS
0.001
3rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
187
of 17,787 indexed, latest versions
Container images
187
deployed by those charts
Fix available
1 of 2
affected packages

@babel/core: Arbitrary File Read via sourceMappingURL Comment

Carried by container images the latest versions of 187 of 17,787 indexed charts deploy, on 187 images.

Affected packageAffected versionsFixed inImages
node-babel7deb7.20.15+ds1+~cs214.269.168-8no fix listed1
@babel/corenpm7.1.0, 7.1.2, 7.5.5, 7.7.2+69 more7.29.6187
OSV records
DEBIAN-CVE-2026-49356GHSA-4x5r-pxfx-6jf8

Charts affected

187 by stars
ChartLatestAffected imagesRadar Score
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
@babel/core@7.21.0
7.29.6

Open the chart page →

4,431
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
@babel/core@7.15.8
7.29.6

Open the chart page →

3,639
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
@babel/core@7.25.2
7.29.6

Open the chart page →

5,499
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
@babel/core@7.29.0
7.29.6

Open the chart page →

1,991
dashysergiotocaliniVerified publisher1.0.01 of 1See more

dashy sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
@babel/core@7.18.2
7.29.6

Open the chart page →

3,143
parkingsikalabs0.1.01 of 1See more

parking sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
ondrejsika/parking:latestb1fd497416c8
@babel/core@7.7.2
7.29.6

Open the chart page →

3,696
sneakerssneakers1.0.01 of 4See more

sneakers sneakers 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
helga09/shoes_ukr:v1.1.17999bc8b77c0
@babel/core@7.21.8
7.29.6

Open the chart page →

7,586
speedtest-trackersoblivionscall3.0.41 of 1See more

speedtest-tracker soblivionscall 3.0.4

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
henrywhitaker3/speedtest-tracker:latest47159a940229
@babel/core@7.12.3
7.29.6

Open the chart page →

2,460
pwssoketi0.2.41 of 1See more

pws soketi 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
quay.io/soketi/pws:0.8-16-alpine399d2e6b10ef
@babel/core@7.15.5
7.29.6

Open the chart page →

3,228
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e12 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
@babel/core@7.23.2
7.29.6

Open the chart page →

15,684
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb2 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
@babel/core@7.23.2
7.29.6

Open the chart page →

16,431
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f82 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
@babel/core@7.23.2
7.29.6

Open the chart page →

14,703
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091142 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
@babel/core@7.23.2
7.29.6

Open the chart page →

16,431
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4692 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d4694bd113093583
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
@babel/core@7.23.2
7.29.6

Open the chart page →

14,245
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3412 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.12-branch.testing3.88744-f55b3414bd113093583
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
@babel/core@7.23.2
7.29.6

Open the chart page →

14,245
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b22 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
@babel/core@7.23.2
7.29.6

Open the chart page →

16,050
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef2 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

2 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
@babel/core@7.17.10
7.29.6
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
@babel/core@7.23.2
7.29.6

Open the chart page →

14,500
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
@babel/core@7.28.3
7.29.6

Open the chart page →

10,647
retail-store-sample-checkout-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
@babel/core@7.27.7
7.29.6

Open the chart page →

1,313
nordmart-reviewstakaterVerified publisher0.0.61 of 3See more

nordmart-review stakater 0.0.6

1 of the 3 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
stakater/stakater-nordmart-review-ui:1.0.143f4926eedc74
@babel/core@7.14.3
7.29.6

Open the chart page →

11,554
nordmart-review-instancestakaterVerified publisher1.0.01 of 3See more

nordmart-review-instance stakater 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
stakater/stakater-nordmart-review-ui:1.0.143f4926eedc74
@babel/core@7.14.3
7.29.6

Open the chart page →

11,554
fdi-dotstatsuite-dlmstatcan0.3.11 of 1See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
@babel/core@7.14.6
7.29.6

Open the chart page →

3,881
fdi-dotstatsuite-sfs-solrstatcan1.0.21 of 4See more

fdi-dotstatsuite-sfs-solr statcan 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
@babel/core@7.29.0
7.29.6

Open the chart page →

6,065
fdi-dotstatsuite-sfs-solr-statefulstatcan1.0.21 of 2See more

fdi-dotstatsuite-sfs-solr-stateful statcan 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
@babel/core@7.29.0
7.29.6

Open the chart page →

920
strapistrapi-xmv0.1.11 of 1See more

strapi strapi-xmv 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
@babel/core@7.29.0
7.29.6

Open the chart page →

676
slack-emoji-makersuminhong0.1.01 of 1See more

slack-emoji-maker suminhong 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
honglab/slack-emoji-maker:v0.0.1ca075a926fe1
@babel/core@7.26.10
7.29.6

Open the chart page →

1,653
tensorzerotensorzero2026.6.01 of 2See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
tensorzero/ui:2026.6.0f2563d54724e
@babel/core@7.29.0
7.29.6

Open the chart page →

3,967
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
samajh/alprfrontend:latest05ef4fddbb75
@babel/core@7.12.3
7.29.6

Open the chart page →

20,362
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
pysga1996/python-redis-web:latestfdeec30ad482
@babel/core@7.12.16
7.29.6

Open the chart page →

4,662
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
vcnngr/pnbackend:latesteaf44ad0ad1f
@babel/core@7.28.0
7.29.6

Open the chart page →

4,769
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
@babel/core@7.14.6
7.29.6

Open the chart page →

3,129
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
@babel/core@7.26.10
7.29.6

Open the chart page →

6,470
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
@babel/core@7.26.10
7.29.6

Open the chart page →

5,774
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
@babel/core@7.12.10
7.29.6

Open the chart page →

10,127
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
@babel/core@7.11.4
7.29.6

Open the chart page →

22,665
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
@babel/core@7.29.0
7.29.6

Open the chart page →

5,472
workadventureworkadventure1.1.02 of 9See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry CVE-2026-49356.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
@babel/core@7.20.7
7.29.6
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
@babel/core@7.20.7
7.29.6

Open the chart page →

16,083

Container images carrying it

187 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
rcdelacruz/my-strapi-app:js-amd6438007f358355
@babel/core@7.23.3
7.29.6
3
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
@babel/core@7.19.3
7.29.6
3
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
@babel/core@7.29.0
7.29.6
3
chatwoot/chatwoot:v3.1.0d530ab8c1753
@babel/core@7.14.0
7.29.6
2
governify/assets-manager:v1.4.12987672448c7
@babel/core@7.15.8
7.29.6
2
library/mongo-express:1.0.2:latest1b23d7976f02
@babel/core@7.19.6
7.29.6
2
mojaloop/role-assignment-service:v2.1.0def4bf273721
@babel/core@7.23.7
7.29.6
2
moreillon/api-proxy:a3e8b41e9e578c9653b6
@babel/core@7.18.2
7.29.6
2
moreillon/group-manager:v4.9.0d5a0ec8394c0
@babel/core@7.22.20
7.29.6
2
moreillon/user-manager:v5.0.2e1c9bfab5c16
@babel/core@7.20.12
7.29.6
2
outlinewiki/outline:0.69.1d060dcd8f9aa
@babel/core@7.21.0
7.29.6
2
requarks/wiki:2:latest68f0d1848261
@babel/core@7.29.0
7.29.6
2
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
@babel/core@7.29.0
7.29.6
2
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d469:2.18.12-branch.testing3.88744-f55b3414bd113093583
@babel/core@7.17.10
7.29.6
2
stakater/stakater-nordmart-review-ui:1.0.143f4926eedc74
@babel/core@7.14.3
7.29.6
2
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
@babel/core@7.18.2
7.29.6
2
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
@babel/core@7.24.4
7.29.6
1
alazidis/stornx:1.1.1602d4f7f090c
@babel/core@7.27.1
7.29.6
1
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
@babel/core@7.5.5
7.29.6
1
amundsendev/amundsen-frontend:2.1.169e7915e61c1
@babel/core@7.7.7
7.29.6
1
anamskenneth/recipe_backend:2025-06-079b7d2cd389b7
@babel/core@7.25.2
7.29.6
1
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
@babel/core@7.25.2
7.29.6
1
apimap/developer:v1.3.1406d3858e20c
@babel/core@7.18.13
7.29.6
1
apimap/portal:v2.4.0041a4790c65c
@babel/core@7.17.5
7.29.6
1
arfath29/3-tier-app-frontend:latest384b3e377f47
@babel/core@7.12.3
7.29.6
1
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
@babel/core@7.11.6
7.29.6
1
assistiot/fl_orchestrator:api-latest7473d77448e1
@babel/core@7.24.5
7.29.6
1
assistiot/open_api_frontend:1.0.1f11d82defc70
@babel/core@7.20.12
7.29.6
1
automatischio/automatisch:0.15.03bace7a12d5f
@babel/core@7.26.10
7.29.6
1
baserow/baserow:1.30.1df0c42eb67e8
@babel/core@7.23.6
7.29.6
1
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
@babel/core@7.20.2
7.29.6
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
@babel/core@7.14.8
7.29.6
1
ccjacobs14/amazon:59a9b14a6f09e
@babel/core@7.21.4
7.29.6
1
chatwoot/chatwoot:v4.15.167ebc751c171
@babel/core@7.14.0
7.29.6
1
chocobozzz/peertube:v8.1.5052712130691
@babel/core@7.29.0
7.29.6
1
coderaiser/cloudcmd:16.6.1b34a9775c7ce
@babel/core@7.19.6
7.29.6
1
codetogether/codetogether:latest4348c8a38752
@babel/core@7.24.6
7.29.6
1
coldatom/containers-security-front:latest7c2fbbb41bcf
@babel/core@7.20.12
7.29.6
1
conduction/conduction-ui-app:devd591f5e6f2a9
@babel/core@7.12.3
7.29.6
1
countly/countly-server:25.05.4e3c238248f99
@babel/core@7.24.7
7.29.6
1
cryptexlabs/authf:0.12.11189c07411d7c
@babel/core@7.25.2
7.29.6
1
dessalines/lemmy-ui:0.19.20ee4c620d8e93
@babel/core@7.25.2
7.29.6
1
dipugodocker/pdf-editor:1.0-frontendd431c37fe1cd
@babel/core@7.19.3
7.29.6
1
drumsergio/lynxprompt:2.0.75c6afb6679301
@babel/core@7.29.0
7.29.6
1
electerious/ackee:3.2.05e7173fa321c
@babel/core@7.15.5
7.29.6
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
@babel/core@7.15.0
7.29.6
1
ethersphere/onboarding-faucet:0.3.0513154aab230
@babel/core@7.17.5
7.29.6
1
ethpandaops/ethereumjs:masterfb84b718500f
@babel/core@7.28.4
7.29.6
1
fallenbagel/jellyseerr:latest4538137bc5af
@babel/core@7.28.0
7.29.6
1
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
@babel/core@7.20.12
7.29.6
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.