debian/node-rollup vulnerabilities

Latest debian/node-rollup CVEs

Newest publication first

1. CVE-2026-27606 Rollup 4 has Arbitrary File Write via Path Traversal

   Published 2026-02-25

   High·CVSS 8.8

   Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine a...

2. CVE-2024-47068 DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

   Published 2024-09-23

   Medium·CVSS 6.1

   Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from import.meta (e.g., import.meta.url) in cjs/umd/iife format. The DOM Clobbering gadget can lead to c...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.