CVE catalog
CVE-2026-27606
Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary Fil
- Severity
- Critical · CVSS 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.65% · Oct 25, 2026
Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-rollup | sid | 3.30.0-7 | fixed |
| Debian | node-rollup | forky | 3.30.0-7 | fixed |
| Debian | node-rollup | trixie | 3.29.5-1 | vulnerable |
| Debian | node-rollup | bookworm | 3.15.0-1+deb12u1 | vulnerable |
| Cpe | node-rollup | Not reported | Not reported | vulnerable |
| Cpe | rollup | Not reported | Not reported | unknown |
| Npm | rollup | Not reported | 2.80.0 | fixed |
| Npm | rollup | Not reported | 3.30.0 | fixed |
| Npm | rollup | Not reported | 4.59.0 | fixed |
| Cpe | rollup | Not reported | 4.59.0 | fixed |
| Opensuse | heroic-games-launcher | tumbleweed | 2.20.0-2.1 | fixed |
| Ubuntu | node-rollup | 20.04 | 0.50.0-6build3 | vulnerable |
| Ubuntu | node-rollup | 20.04 | 0.68.2-2 | vulnerable |
| Ubuntu | node-rollup | 20.04 | 1.12.0-2build2 | vulnerable |
| Ubuntu | node-rollup | 20.04 | 1.12.0-2build3 | vulnerable |
| Ubuntu | node-rollup | 22.04 | 2.38.4-1 | vulnerable |
| Ubuntu | node-rollup | 22.04 | 2.42.1-2 | vulnerable |
| Ubuntu | node-rollup | 22.04 | 2.61.1-5 | vulnerable |
| Ubuntu | node-rollup | 24.04 | 3.28.0-2 | vulnerable |
| Ubuntu | node-rollup | 24.04 | 3.29.4-2 | vulnerable |
| Ubuntu | node-rollup | 24.04 | 3.29.4-3 | vulnerable |
| Ubuntu | node-rollup | 25.10 | 3.29.5-1 | vulnerable |
| Ubuntu | node-rollup | 26.10 | 3.30.0-1 | vulnerable |
| Ubuntu | node-rollup | 26.10 | 3.30.0-5build5 | vulnerable |
| Ubuntu | node-rollup | 26.04 | 3.29.5-1 | vulnerable |
| Ubuntu | node-rollup | 26.04 | 3.30.0-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-rollup | source | sid | 3.30.0-1 | not yet assigned | Not reported | [1129260] |
| Debian | node-rollup | source | forky | 3.30.0-1 | not yet assigned | Not reported | [1129260] |
| Debian | node-rollup | source | trixie | (unfixed) | not yet assigned | Not reported | [1129260] |
| Debian | node-rollup | source | bookworm | (unfixed) | not yet assigned | Not reported | [1129260] |
| Npm | rollup | npm | Not reported | 2.80.0 | Not reported | Not reported | Not reported |
| Npm | rollup | npm | Not reported | 3.30.0 | Not reported | Not reported | Not reported |
| Npm | rollup | npm | Not reported | 4.59.0 | Not reported | Not reported | Not reported |
| Cpe | rollup | cpe | Not reported | 4.59.0 | Not reported | NVD-CVE-2026-27606 | Not reported |
| Opensuse | heroic-games-launcher | rpm | tumbleweed | 2.20.0-2.1 | Not reported | OPENSUSE-SU-2026:10263-1 | Not reported |
Notes
[trixie] node-rollup: Minor issue [bookworm] node-rollup: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [rollup]Affected
Source package: [node-rollup]
Details (2)
3.15.0-1+deb12u1· all · bookwormAffected
nvd · node-rollup · debian · bookworm; nvd · node-rollup · debian · 12
3.15.0-1+deb12u1· all · bookwormAffected
nvd · node-rollup · debian · bookworm; nvd · node-rollup · debian · 12
[Debian 13 (Trixie)]
- [rollup]Affected
Source package: [node-rollup]
Details (2)
3.29.5-1· all · trixieAffected
nvd · node-rollup · debian · 13
3.29.5-1· all · trixieAffected
nvd · node-rollup · debian · 13
[openSUSE Tumbleweed]
- [heroic-games-launcher]Fixed
Source package: [heroic-games-launcher]
Details (1)
2.22.1-1.1· x86_64 · tumbleweedFixed · Fixed:
2.20.0-2.1nvd · heroic-games-launcher · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11126-1.json]
- [https://github.com/advisories/GHSA-mw96-cpmx-2vgc]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-27606]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-27606]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-27606]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10263-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-27606]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27606.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2923.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]