CVE-2026-27606
1 advisory.
npm/rollup CVE-2026-27606: high, EPSS 1.73%
Rollup 4 has Arbitrary File Write via Path Traversal
Action: Upgrade rollup to 2.80.0 or later.
npm i rollup@2.80.0npm i rollup@3.30.0npm i rollup@4.59.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.80.0 | - |
| 3.0.0 | 3.30.0 | - |
| 4.0.0 | 4.59.0 | - |
Fixed versions
| 2.80.0 | 3.30.0 | 4.59.0 |
Sources
- osv: GHSA-mw96-cpmx-2vgc
- https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc
- https://nvd.nist.gov/vuln/detail/CVE-2026-27606
- https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2
- https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e
- https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3
- https://github.com/rollup/rollup
- https://github.com/rollup/rollup/releases/tag/v2.80.0
- https://github.com/rollup/rollup/releases/tag/v3.30.0
- https://github.com/rollup/rollup/releases/tag/v4.59.0
CVE-2026-27606 · published · modified · JSON