CVE-2024-47068

npm/rollup CVE-2024-47068: medium 6.4

DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

Action: Upgrade rollup to 2.79.2 or later.

npm i rollup@3.29.5

npm i rollup@4.22.4

npm i rollup@2.79.2

Affected

Fixed versions

Sources

• osv: GHSA-gcx4-mw62-g8wm
• https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm
• https://nvd.nist.gov/vuln/detail/CVE-2024-47068
• https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4
• https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541
• https://github.com/rollup/rollup
• https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162
• https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185

CVE-2024-47068 · published 2024-09-23T22:11:02Z · modified 2026-09-10T03:50:18.179909724Z · JSON