{"cve":"CVE-2026-27606","nvd":{"published":"2026-02-25T03:16:04.603","modified":"2026-09-10T13:18:01.097","status":"Modified","description":"Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","score":8.8},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-22"],"references":["https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2","https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e","https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3","https://github.com/rollup/rollup/releases/tag/v2.80.0","https://github.com/rollup/rollup/releases/tag/v3.30.0"],"products":["rollupjs:rollup"],"source":"nvd","synced_at":"2026-10-19T22:24:17.937441719+00:00"},"epss":{"cve":"CVE-2026-27606","score":0.01651,"percentile":0.76533,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-mw96-cpmx-2vgc","url":"https://osv.dev/vulnerability/GHSA-mw96-cpmx-2vgc","summary":"Rollup 4 has Arbitrary File Write via Path Traversal","modified":"2026-09-10T03:50:35.380273715Z","packages":[{"ecosystem":"npm","name":"rollup","purl":"pkg:npm/rollup","ranges":["<2.80.0"],"fixed":["2.80.0"]},{"ecosystem":"npm","name":"rollup","purl":"pkg:npm/rollup","ranges":[">=3.0.0 <3.30.0"],"fixed":["3.30.0"]},{"ecosystem":"npm","name":"rollup","purl":"pkg:npm/rollup","ranges":[">=4.0.0 <4.59.0"],"fixed":["4.59.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}