Skip to content
OpenAdvisories

Package · Debian

node-rollup

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.8
    CVE-2026-27606 Public exploit

    Rollup 4 has Arbitrary File Write via Path Traversal

    Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization…

    rollup rollup node-rollup rollup Debian Ubuntu npm
  • Medium 6.1
    CVE-2024-47068

    DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

    Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM …

    rollup rollup rollup node-rollup Debian Ubuntu npm