Which versions of Rollup are affected by CVE-2026-27606?

Rollup, a widely-used JavaScript build tool, contains a vulnerability affecting versions 4.x (before 4.59.0), 3.x (before 3.30.0), and 2.x (before 2.80.0) that allows attackers to inject malicious…. A patch is available.

Is there a public PoC exploit available for CVE-2026-27606?

Yes, a public proof-of-concept exploit is available for CVE-2026-27606. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2026-27606?

Within 24 hours: Inventory all Rollup installations and identify version numbers currently in use. Within 7 days: Upgrade all Rollup instances to patched versions (4.59.0 or later for 4.x; 3.30.0 or later for 3.x; 2.80.0 or later for 2.x), and rebuild all artifacts in a clean environment. Within 30 days: Validate build integrity through code review of artifacts; implement mandatory approval for build configuration changes; restrict build-system access to essential personnel only.

Rollup CVE-2026-27606

Q: What is the CVSS score of CVE-2026-27606?

CVE-2026-27606 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

HIGH

Path Traversal (CWE-22)

2026-02-25 security-advisories@github.com

GHSA-mw96-cpmx-2vgc

RCE Path Traversal Rollup

8.8

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Exploitation requires attacker-controlled build inputs/plugins (local/supply-chain, so AV:L and PR:L); arbitrary file overwrite yields high integrity/availability impact but no direct confidentiality loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

9.1 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 05:23 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:22 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:22 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:21 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:23 vuln.today

cvss_changed

Severity Changed

Jun 30, 2026 - 03:23 NVD

CRITICAL HIGH

CVSS changed

Jun 30, 2026 - 03:23 NVD

9.8 (CRITICAL) 8.8 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 25, 2026 - 16:05 vuln.today

Public exploit code

Patch released

Feb 25, 2026 - 16:05 nvd

Patch available

CVE Published

Feb 25, 2026 - 03:16 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on rollup (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.0.0.

DescriptionCVE.org

Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.

AnalysisAI

Arbitrary file write via path traversal in the Rollup JavaScript module bundler lets an attacker who can influence build inputs write or overwrite files anywhere the build process can reach, escalating to persistent remote code execution by clobbering system or user configuration files. Affected are 4.x releases before 4.59.0 (and the 2.x/3.x lines before 2.80.0 and 3.30.0), where insecure output filename sanitization permits ../ traversal through CLI named inputs, manual chunk aliases, or malicious plugins. Publicly available exploit code exists (GitHub Security Advisory GHSA-mw96-cpmx-2vgc), though no public exploit is identified as active in-the-wild use; EPSS is modest at 0.62% (70th percentile).

Technical ContextAI

Rollup is one of the most widely used JavaScript/TypeScript module bundlers, embedded in the toolchains of Vite, enterprise build pipelines, and countless npm packages, and distributed as the rollupjs:rollup Node.js package per the CPE data. The flaw is a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): Rollup derives output file paths from caller-supplied identifiers - command-line named inputs, manualChunks aliases, and plugin-provided emitFile names - but fails to neutralize directory-traversal sequences before resolving the destination. Because the bundler then writes emitted assets/chunks to those resolved paths with the build process's privileges, an attacker-controlled name containing ../ escapes the configured output directory and lands the write at an arbitrary location on the host.

RemediationAI

Vendor-released patch: upgrade to Rollup 4.59.0 (4.x), 3.30.0 (3.x), or 2.80.0 (2.x) per the release notes at https://github.com/rollup/rollup/releases/tag/v4.59.0, /v3.30.0, and /v2.80.0; the fix commits are c60770d, c8cf1f9, and d6dee5e referenced from advisory GHSA-mw96-cpmx-2vgc. Distribution users should apply the corresponding errata: Red Hat RHSA-2026:5132/5649/5665/6174/6802/10175 and SUSE SU-2026:1013/1148. Where an immediate upgrade is not possible, reduce exposure by not bundling untrusted source trees or third-party Rollup plugins, pinning and vetting dependencies that invoke Rollup, and running builds as an unprivileged user inside an ephemeral/sandboxed container with the output directory on a separate mount so a traversal write cannot reach system or user config files; the trade-offs are added CI complexity and the need to continuously audit plugin supply chains. Avoid passing externally-influenced values as CLI named inputs or manualChunks aliases until patched.

More in Rollup

View all

CVE-2024-47068 MEDIUM This Month POC

6.1 Sep 23

Rollup is a module bundler for JavaScript. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable,

Same weakness CWE-22 – Path Traversal

View all

CVE-2019-3396 CRITICAL POC

9.8

CVE-2019-19781 CRITICAL POC

9.8

CVE-2020-5902 CRITICAL POC

9.8

CVE-2021-21972 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2022-41352 CRITICAL POC

9.8

CVE-2021-27065 HIGH POC

7.8

CVE-2019-11510 CRITICAL POC

10.0

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
Container suse/manager/5.0/x86_64/server:latest	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Manager Client Tools 15	Fixed
SUSE Manager Client Tools for SLE Micro 5	Fixed
SUSE Manager Proxy LTS 4.3	Fixed

CVE-2026-27606 vulnerability details – vuln.today

Back

Rollup CVE-2026-27606

Severity by source

CVSS VectorVendor: github

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Rollup

Same weakness CWE-22 – Path Traversal

Same technique RCE

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code