DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
Priority MEDIUM 60CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 2 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the vulnerability.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00742 54th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial rollup (rollup): 3.29.5, 4.22.4, 2.79.2rollup (npm): 3.29.5, 4.22.4, 2.79.2Red Hat: 3 advisoriesRed Hat: 2 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rollup | rollup | 3.0.0 to before 3.29.5; 4.0.0 to before 4.22.4; before 2.79.2 | 3.29.5, 4.22.4, 2.79.2 | Patch available | CNA |
| — | rollup (npm) | 3.0.0 to before 3.29.5 | 3.29.5 | Patch available | GHSA-gcx4-mw62-g8wm |
| — | rollup (npm) | 4.0.0 to before 4.22.4 | 4.22.4 | Patch available | GHSA-gcx4-mw62-g8wm |
| — | rollup (npm) | before 2.79.2 | 2.79.2 | Patch available | GHSA-gcx4-mw62-g8wm |
- rollup Vendorrollup Affected 3.0.0 to before 3.29.5; 4.0.0 to before 4.22.4; before 2.79.2 Fixed in 3.29.5, 4.22.4, 2.79.2 Patch available CNA
- rollup (npm) Vendor— Affected 3.0.0 to before 3.29.5 Fixed in 3.29.5 Patch available GHSA-gcx4-mw62-g8wm
- rollup (npm) Vendor— Affected 4.0.0 to before 4.22.4 Fixed in 4.22.4 Patch available GHSA-gcx4-mw62-g8wm
- rollup (npm) Vendor— Affected before 2.79.2 Fixed in 2.79.2 Patch available GHSA-gcx4-mw62-g8wm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rollupjs:rollup:*:*:*:*:*:node.js:*:* | 0.59.0 to before 2.79.2; 3.0.0 to before 3.29.5; 4.0.0 to before 4.22.4 | Vulnerable | Rollupjs |
- cpe:2.3:a:rollupjs:rollup:*:*:*:*:*:node.js:*:* Versions 0.59.0 to before 2.79.2; 3.0.0 to before 3.29.5; 4.0.0 to before 4.22.4 Vulnerable ·Rollupjs
Remediation
- Fix · CNA rollup (rollup) Fixed in 3.29.5, 4.22.4, 2.79.2
- Fix · GHSA-gcx4-mw62-g8wm rollup (npm) Fixed in 3.29.5 Advisory →
- Fix · GHSA-gcx4-mw62-g8wm rollup (npm) Fixed in 4.22.4 Advisory →
- Fix · GHSA-gcx4-mw62-g8wm rollup (npm) Fixed in 2.79.2 Advisory →
Red Hat 3 advisories
- RHSA-2025:3374 Released 2025-03-27 · Red Hat rating ImportantRed Hat Developer Hub 1.5.1 release.
- Red Hat Developer Hub 1.5 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2024:10962 Released 2024-12-11 · Red Hat rating ImportantRed Hat OpenShift distributed tracing platform (Jaeger) 3.4 release
- Red Hat OpenShift distributed tracing 3.4 registry.redhat.io/rhosdt/jaeger-query-rhel8
- RHSA-2024:10917 Released 2024-12-10 · Red Hat rating ImportantRed Hat OpenShift distributed tracing platform (Jaeger) 3.4 release
- Red Hat OpenShift distributed tracing 3.4 registry.redhat.io/rhosdt/jaeger-query-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 7 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Runtimes | Affected | No fix planned: Will not fix |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Network Observability Operator | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
| Red Hat Developer Hub 1.5 | Fixed | RHSA-2025:3374 |
| Red Hat OpenShift distributed tracing 3.4 | Fixed | RHSA-2024:10917, RHSA-2024:10962 |
Not affected: 23 products
- Migration Toolkit for Applications 7
- Multicluster Engine for Kubernetes
- OpenShift Pipelines
- OpenShift Service Mesh 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Keycloak
- Red Hat Developer Hub 1
- Red Hat Developer Hub 1.5
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat OpenShift GitOps
- Red Hat OpenShift distributed tracing 3
- Red Hat OpenShift distributed tracing 3.4
- Red Hat Quay 3
- Red Hat Single Sign-On 7
- Red Hat Trusted Profile Analyzer
- Red Hat build of OptaPlanner 8
Timeline
- 2026-10-02 Threatist record created from CVE-2024-47068
- 2026-10-03 Alias added: GHSA-gcx4-mw62-g8wm
- 2026-10-27 Affected versions changed · Red Hat
References
Patch 2
More Rollupjs Rollup vulnerabilities
- TI-2026-21992 Rollup 4 has Arbitrary File Write via Path Traversal CVSS 4.0HIGH 8.8
Sources
- CVE-2024-47068 · CVE Program
- CVE-2024-47068 · NVD
- FIRST EPSS
- GHSA-gcx4-mw62-g8wm · GitHub Advisory Database · CC BY 4.0
- CVE-2024-47068 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences