{
  "@id": "urn:uuid:ef23699c-0a1b-4a7e-a3b4-64184d96e3dd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-15T22:33:00.263051+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40babel/core@7.29.6",
          "identifiers": {
            "purl": "pkg:npm/%40babel/core@7.29.6"
          }
        }
      ],
      "timestamp": "2026-10-15T22:33:00.263051+00:00",
      "status_notes": "Vulnerability CVE-2026-49356 does not affect version 7.29.6 of @babel/core. not_affected \u2014 Babel 7.29.6 is NOT affected by CVE-2026-49356. The vulnerability (arbitrary file read via sourceMappingURL path traversal) was fixed in the upstream Babel 7.29.6 release via commit 99f498a9b9. The vulnerable pattern (direct fs.readFileSync without path validation) is not present in the target; it was replaced with readInputSourceMapFile() which validates source map URLs and rejects paths that ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-49356"
      },
      "impact_statement": "not_affected \u2014 Babel 7.29.6 is NOT affected by CVE-2026-49356. The vulnerability (arbitrary file read via sourceMappingURL path traversal) was fixed in the upstream Babel 7.29.6 release via commit 99f498a9b9. The vulnerable pattern (direct fs.readFileSync without path validation) is not present in the target; it was replaced with readInputSourceMapFile() which validates source map URLs and rejects paths that ..."
    }
  ]
}