{"action":"Upgrade rollup to 2.79.2 or later.","affected":[{"fixed":"3.29.5","introduced":"3.0.0"},{"fixed":"4.22.4","introduced":"4.0.0"},{"fixed":"2.79.2","introduced":"0"}],"component":"rollup","cve_ids":["CVE-2024-47068"],"ecosystem":"npm","epss":0.00742,"exploited":false,"fixed_versions":["3.29.5","4.22.4","2.79.2"],"ghsa_id":"GHSA-gcx4-mw62-g8wm","id":"tcs_01M5KFRDQFKPMRMTJ6VXDPQHY2","modified_at":"2026-09-10T03:50:18.179909724Z","published_at":"2024-09-23T22:11:02Z","references":["https://osv.dev/vulnerability/GHSA-gcx4-mw62-g8wm","https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm","https://nvd.nist.gov/vuln/detail/CVE-2024-47068","https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4","https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541","https://github.com/rollup/rollup","https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162","https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-gcx4-mw62-g8wm","url":"https://osv.dev/vulnerability/GHSA-gcx4-mw62-g8wm"}],"summary":"DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS"}