Rollup 4 has Arbitrary File Write via Path Traversal
Priority HIGH 79CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 10 fixed, 7 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01651 76th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial rollup (rollup): 2.80.0, 3.30.0, 4.59.0rollup (npm): 2.80.0, 3.30.0, 4.59.0Red Hat: 10 advisoriesRed Hat: 10 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rollup | rollup | before 2.80.0; 3.0.0 to before 3.30.0; 4.0.0 to before 4.59.0 | 2.80.0, 3.30.0, 4.59.0 | Patch available | CNA |
| — | rollup (npm) | before 2.80.0 | 2.80.0 | Patch available | GHSA-mw96-cpmx-2vgc |
| — | rollup (npm) | 3.0.0 to before 3.30.0 | 3.30.0 | Patch available | GHSA-mw96-cpmx-2vgc |
| — | rollup (npm) | 4.0.0 to before 4.59.0 | 4.59.0 | Patch available | GHSA-mw96-cpmx-2vgc |
- rollup Vendorrollup Affected before 2.80.0; 3.0.0 to before 3.30.0; 4.0.0 to before 4.59.0 Fixed in 2.80.0, 3.30.0, 4.59.0 Patch available CNA
- rollup (npm) Vendor— Affected before 2.80.0 Fixed in 2.80.0 Patch available GHSA-mw96-cpmx-2vgc
- rollup (npm) Vendor— Affected 3.0.0 to before 3.30.0 Fixed in 3.30.0 Patch available GHSA-mw96-cpmx-2vgc
- rollup (npm) Vendor— Affected 4.0.0 to before 4.59.0 Fixed in 4.59.0 Patch available GHSA-mw96-cpmx-2vgc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rollupjs:rollup:*:*:*:*:*:node.js:*:* | before 2.80.0; 3.0.0 to before 3.30.0; 4.0.0 to before 4.59.0 | Vulnerable | Rollupjs |
- cpe:2.3:a:rollupjs:rollup:*:*:*:*:*:node.js:*:* Versions before 2.80.0; 3.0.0 to before 3.30.0; 4.0.0 to before 4.59.0 Vulnerable ·Rollupjs
Remediation
- Fix · CNA rollup (rollup) Fixed in 2.80.0, 3.30.0, 4.59.0
- Fix · GHSA-mw96-cpmx-2vgc rollup (npm) Fixed in 2.80.0 Advisory →
- Fix · GHSA-mw96-cpmx-2vgc rollup (npm) Fixed in 3.30.0 Advisory →
- Fix · GHSA-mw96-cpmx-2vgc rollup (npm) Fixed in 4.59.0 Advisory →
Red Hat 10 advisories
- RHSA-2026:13545 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9 +11
- RHSA-2026:13512 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.28-3.el8ap, automation-gateway-proxy-2.5.10-5.el8ap, automation-gateway-proxy-server-2.5.10-5.el8ap +19
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.28-3.el9ap, automation-gateway-proxy-2.6.14-2.el9, automation-gateway-proxy-server-2.6.14-2.el9 +19
- RHSA-2026:13508 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.4-3.el10ap, receptorctl-1.6.4-3.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.11-2.el9ap, automation-controller-cli-4.7.11-2.el9ap, automation-controller-server-4.7.11-2.el9ap +25
Show 7 more Red Hat advisories
- RHSA-2026:10175 Released 2026-04-23 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.27.1 Release.
- Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/devspaces-rhel9-operator +8
- RHSA-2026:8483 Released 2026-04-16 · Red Hat rating CriticalKiali 1.73.29 for Red Hat OpenShift Service Mesh 2.6
- Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8, registry.redhat.io/openshift-service-mesh/kiali-rhel8
- RHSA-2026:6802 Released 2026-04-07 · Red Hat rating ImportantRed Hat Developer Hub 1.9.3 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:6174 Released 2026-03-30 · Red Hat rating ImportantRed Hat Developer Hub 1.8.5 release.
- Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:5665 Released 2026-03-24 · Red Hat rating ImportantRed Hat Quay 3.10.19
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:5649 Released 2026-03-24 · Red Hat rating ImportantRHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rhtas-console-rhel9, registry.redhat.io/rhtas/rhtas-console-ui-rhel9
- RHSA-2026:5132 Released 2026-03-19 · Red Hat rating ImportantKiali 1.73.28 for Red Hat OpenShift Service Mesh 2.6
- Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/kiali-rhel8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Build of Podman Desktop - Tech Preview | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Self-service automation portal 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:13545 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:13508 |
| Red Hat Developer Hub 1.8 | Fixed | RHSA-2026:6174 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:6802 |
| Red Hat OpenShift Dev Spaces 3.27 | Fixed | RHSA-2026:10175 |
| Red Hat OpenShift Service Mesh 2.6 | Fixed | RHSA-2026:5132, RHSA-2026:8483 |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:5665 |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2026:5649 |
Not affected: 25 products
- OpenShift Pipelines
- OpenShift Service Mesh 3
- Red Hat AMQ Broker 7
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.6 for RHEL 10
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Build of Podman Desktop - Tech Preview
- Red Hat Developer Hub 1.8
- Red Hat Developer Hub 1.9
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces 3.27
- Red Hat OpenShift Service Mesh 2.6
- Red Hat Quay 3.10
- Red Hat Trusted Artifact Signer 1.3
- Red Hat build of OptaPlanner 8
Timeline
- 2026-10-02 Threatist record created from CVE-2026-27606
- 2026-10-03 Alias added: GHSA-mw96-cpmx-2vgc
References
Patch 3
More Rollupjs Rollup vulnerabilities
- TI-2024-31450 DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-27606 · CVE Program
- CVE-2026-27606 · NVD
- FIRST EPSS
- GHSA-mw96-cpmx-2vgc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-27606 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences