Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Details The vulnerability is caused by the combination of two flawed components in the Rollup core: 1. Improper Sanitization: In src/utils/sanitizeFileName.ts, the INVALIDCHARREGEX used to clean user-provided names for chunks and assets excludes the period (.) and forward/backward slashes (/, \). This allows path traversal sequences like ../../ to pass through the sanitizer unmodified. 2. Unsafe Path Resolution: In…
Recommended action: Upgrade to 4.59.0, 3.30.0 or 2.80.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
We discovered a DOM Clobbering vulnerability in rollup when bundling scripts that use import.meta.url or with plugins that emit and reference asset files from code in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. It's worth noting that we’ve identifed similar issues in other popular bundlers like Webpack (CVE-2024-43788), which might serve as a good reference. Details Backgrounds DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. More for information about DOM Clobbering, here are some references: [1] https://scnps.co/papers/sp23domclob.pdf [2]…
Recommended action: Upgrade to 4.22.4, 3.29.5 or 2.79.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.