Skip to main content

Rollup CVE-2026-27606

HIGH
Path Traversal (CWE-22)
2026-02-25 security-advisories@github.com GHSA-mw96-cpmx-2vgc
RCE Path Traversal Rollup
8.8
CVSS 4.0 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Publish or compromise malicious Rollup plugin/dependency
  2. Delivery
    Victim runs build with vulnerable Rollup
  3. Exploit
    Emit output name containing ../ traversal
  4. Install
    Bundler writes file outside output dir
  5. C2
    Overwrite user/system config file
  6. Execute
    Planted payload executes on next run
  7. Impact
    Persistent RCE in build context

Vulnerability Assessment

Weakness
CWE
CWE-22
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK

2 techniques across 2 tactics: Discovery, Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The attacker must be able to influence a build output name processed by Rollup - specifically a CLI named input, a manualChunks alias, or a plugin-supplied emitted-file name - and that value must contain ../ traversal sequences; the write succeeds only at filesystem locations the build process already has permission to modify. Exploitation is therefore gated on supplying or controlling build-time code/configuration (a malicious or compromised plugin/dependency, or a build over untrusted source) and is bounded by the build process's privileges and by use of a vulnerable version (<4.59.0, <3.30.0, <2.80.0). It is not exploitable against a running Rollup service over the network - despite the AV:N rating - because there is no listening attack surface; the 'network' angle is realized through poisoned dependencies/plugins reaching the build.
Impact

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H) scores 8.8 and frames this as network-reachable and unauthenticated, but that framing is generous: exploitation is fundamentally a build-time/supply-chain issue requiring the attacker to control build inputs (named CLI inputs, chunk aliases, or a malicious plugin/dependency), so 'network' realistically means a poisoned dependency or untrusted source tree rather than a remote service request - verify intended attack surface before treating as internet-facing. EPSS is low-to-moderate at 0.62% (70th percentile) and the SSVC exploitation signal is Proof-of-Concept (E:P in the vector), consistent with public PoC but no confirmed active exploitation and no CISA KEV listing. The genuine risk concentrates in CI/CD and developer environments that bundle untrusted code or third-party plugins, where the high integrity impact (arbitrary file overwrite leading to RCE) is real; for teams that only build first-party, trusted code the practical risk is considerably lower than the 8.8 implies. Net: a meaningful supply-chain hardening priority, not an internet-facing emergency.
Exploit ScenarioDerived

An attacker publishes or compromises a Rollup plugin (or an npm dependency that registers one) that emits an asset named like ../../../../home/ci/.bashrc or a CI deploy hook; when a victim project bundles with a vulnerable Rollup, the traversal write overwrites that file with attacker-controlled content. The next time the shell or build runs, the planted payload executes, yielding persistent RCE in the developer or CI context. Public PoC exists in the GitHub advisory, and the low attack complexity makes weaponization straightforward once build-input control is achieved.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jun 30, 2026

Arbitrary file write via path traversal in the Rollup JavaScript module bundler lets an attacker who can influence build inputs write or overwrite files anywhere the build process can reach, escalating to persistent remote code execution by clobbering system or user configuration files. Affected are 4.x releases before 4.59.0 (and the 2.x/3.x lines before 2.80.0 and 3.30.0), where insecure output filename sanitization permits ../ traversal through CLI named inputs, manual chunk aliases, or malicious plugins. Publicly available exploit code exists (GitHub Security Advisory GHSA-mw96-cpmx-2vgc), though no public exploit is identified as active in-the-wild use; EPSS is modest at 0.62% (70th percentile).

Earlier versions of this analysis (4)
v4 Jun 30, 2026 - 05:22 cvss changed CVSS 8.8

Arbitrary file write via path traversal in the Rollup JavaScript module bundler (v4.x prior to 4.59.0, plus 2.x prior to 2.80.0 and 3.x prior to 3.30.0) lets an actor who can influence build inputs write files outside the intended output directory. By supplying '../' sequences through CLI named inputs, manual chunk aliases, or a malicious plugin, an attacker can overwrite arbitrary host files the build process can access, escalating to persistent remote code execution by clobbering system or user configuration files. Publicly available exploit code exists (GHSA-mw96-cpmx-2vgc), though EPSS is low at 0.62% (70th percentile) and the issue is not in CISA KEV.

v3 Jun 30, 2026 - 05:22 cvss changed CVSS 8.8

Arbitrary file write via path traversal in the Rollup JavaScript module bundler (versions before 2.80.0, 3.30.0, and 4.59.0) lets an attacker who controls output filenames - through CLI named inputs, manual chunk aliases, or a malicious plugin - write or overwrite files anywhere the build process can reach using ../ sequences. Because attacker-chosen paths can clobber user or system configuration files, this escalates to persistent remote code execution on the build host. Publicly available exploit code exists and the GitHub-issued advisory (GHSA-mw96-cpmx-2vgc) is corroborated by Red Hat and SUSE errata; EPSS is modest at 0.62% (70th percentile).

v2 Jun 30, 2026 - 05:21 cvss changed CVSS 8.8

Arbitrary file write via path traversal in the Rollup JavaScript module bundler (v4.x and earlier 2.x/3.x branches) lets an actor who can influence build output filenames - through CLI named inputs, manual chunk aliases, or a malicious plugin - supply ../ traversal sequences that escape the output directory and overwrite any file the build process can access, yielding persistent remote code execution by clobbering system or user config files. All versions prior to 2.80.0, 3.30.0, and 4.59.0 are affected. Publicly available exploit code exists (GitHub Security Advisory GHSA-mw96-cpmx-2vgc), but EPSS is modest (0.62%, 70th percentile) and the issue is not in CISA KEV.

v1 Mar 12, 2026 - 21:55 CVSS 9.8

Path traversal in Rollup module bundler during build process.

RemediationAI

Vendor-released patch: upgrade to Rollup 4.59.0 (4.x), 3.30.0 (3.x), or 2.80.0 (2.x) per the release notes at https://github.com/rollup/rollup/releases/tag/v4.59.0, /v3.30.0, and /v2.80.0; the fix commits are c60770d, c8cf1f9, and d6dee5e referenced from advisory GHSA-mw96-cpmx-2vgc. Distribution users should apply the corresponding errata: Red Hat RHSA-2026:5132/5649/5665/6174/6802/10175 and SUSE SU-2026:1013/1148. Where an immediate upgrade is not possible, reduce exposure by not bundling untrusted source trees or third-party Rollup plugins, pinning and vetting dependencies that invoke Rollup, and running builds as an unprivileged user inside an ephemeral/sandboxed container with the output directory on a separate mount so a traversal write cannot reach system or user config files; the trade-offs are added CI complexity and the need to continuously audit plugin supply chains. Avoid passing externally-influenced values as CLI named inputs or manualChunks aliases until patched.

Affected Packages

npm rollup fix: 2.80.0, 3.30.0, 4.59.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Rollup is one of the most widely used JavaScript/TypeScript module bundlers, embedded in the toolchains of Vite, enterprise build pipelines, and countless npm packages, and distributed as the rollupjs:rollup Node.js package per the CPE data. The flaw is a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): Rollup derives output file paths from caller-supplied identifiers - command-line named inputs, manualChunks aliases, and plugin-provided emitFile names - but fails to neutralize directory-traversal sequences before resolving the destination. Because the bundler then writes emitted assets/chunks to those resolved paths with the build process's privileges, an attacker-controlled name containing ../ escapes the configured output directory and lands the write at an arbitrary location on the host.

Know when Rollup gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 8.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
vuln.today AI 7.1 HIGH

Exploitation requires attacker-controlled build inputs/plugins (local/supply-chain, so AV:L and PR:L); arbitrary file overwrite yields high integrity/availability impact but no direct confidentiality loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 9.1 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

9
Analysis Updated
Jun 30, 2026 - 05:23 vuln.today
v5 - CVSS changed
Analysis Updated
Jun 30, 2026 - 05:22 vuln.today
v4 - CVSS changed
Analysis Updated
Jun 30, 2026 - 05:22 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 05:21 vuln.today
v2 - CVSS changed
Severity Changed
Jun 30, 2026 - 03:23 NVD
CRITICAL HIGH
CVSS changed
Jun 30, 2026 - 03:23 NVD
9.8 (CRITICAL) 8.8 (HIGH)
PoC Detected
Feb 25, 2026 - 16:05 vuln.today
Public exploit code
Patch released
Feb 25, 2026 - 16:05 nvd
Patch available
CVE Published
Feb 25, 2026 - 03:16 nvd
CRITICAL 9.8

DescriptionCVE.org

Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on rollup (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.0.0.

Executive ViewAI

Why It Matters

Rollup, a widely-used JavaScript build tool, contains a vulnerability affecting versions 4.x (before 4.59.0), 3.x (before 3.30.0), and 2.x (before 2.80.0) that allows attackers to inject malicious code into applications during the build process. Any organization using an affected version risks compromised software releases and silent introduction of backdoors into deployed systems. Without patching, even trusted build processes cannot guarantee code integrity.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.6%
Top 30% exploitable
Prevalence
Ubiquitous
core JS bundler underpinning Vite and countless npm build pipelines
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

65
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +44
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:rollupjs:rollup:*:*:*:*:*:node.js:*:*
cpe:2.3:a:rollupjs:rollup:*:*:*:*:*:node.js:*:*
cpe:2.3:a:rollupjs:rollup:*:*:*:*:*:node.js:*:*

More in Rollup

View all
CVE-2024-47068 MEDIUM POC
6.1 Sep 23

Rollup is a module bundler for JavaScript. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable,

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
Container suse/manager/5.0/x86_64/server:latest Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Manager Client Tools 15 Fixed
SUSE Manager Client Tools for SLE Micro 5 Fixed
SUSE Manager Proxy LTS 4.3 Fixed

References

Advisories & patches
PATCH https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2 PATCH https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e PATCH https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3 ADVISORY https://access.redhat.com/errata/RHSA-2026:5132 ADVISORY https://access.redhat.com/errata/RHSA-2026:5649 ADVISORY https://access.redhat.com/errata/RHSA-2026:5665 ADVISORY https://access.redhat.com/errata/RHSA-2026:6174 ADVISORY https://access.redhat.com/errata/RHSA-2026:6802 ADVISORY https://vuldb.com/vuln/347716 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1013/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1148/ REF https://access.redhat.com/errata/RHSA-2026:10175 REF https://access.redhat.com/errata/RHSA-2026:13508 REF https://access.redhat.com/errata/RHSA-2026:13512 REF https://access.redhat.com/errata/RHSA-2026:13545 REF https://access.redhat.com/errata/RHSA-2026:8483 REF https://access.redhat.com/security/cve/CVE-2026-27606 REF https://bugzilla.redhat.com/show_bug.cgi?id=2442530 REF https://github.com/rollup/rollup/releases/tag/v2.80.0 REF https://github.com/rollup/rollup/releases/tag/v3.30.0 REF https://github.com/rollup/rollup/releases/tag/v4.59.0 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27606.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy