CVE-2026-27606: Rollup Arbitrary File Write Vulnerability via Path Traversal
Summary
CVE-2026-27606: Rollup 4 has Arbitrary File Write via Path Traversal. Affects rollup across 3 version ranges.
< 2.80.0
>= 3.0.0, < 3.30.0
>= 4.0.0, < 4.59.0
Fixed in 2.80.0, 3.30.0 or 4.59.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Rollup is a popular JavaScript module bundler that compiles small pieces of code into larger, more complex applications. It is widely used in modern web development for its ability to optimize and manage dependencies efficiently. However, versions 4.x and earlier are susceptible to a critical vulnerability that allows attackers to manipulate file paths, potentially leading to unauthorized file writes on the host system.
Vulnerability Detail
The vulnerability arises from improper sanitization of file names in the Rollup core, specifically in the sanitizeFileName function. The regex used to clean user-provided names fails to exclude certain characters, such as periods and slashes, allowing path traversal sequences like '../' to bypass the sanitizer. This, combined with unsafe path resolution in the writeOutputFile function, enables attackers to overwrite files outside the intended output directory, leading to arbitrary file write and potential remote code execution.
How To Fix
Latest published version: 4.65.0 as of 22 Oct 2026
npm install rollup@4.65.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.80.02.80.0npm install rollup@2.80.0 -
>= 3.0.0, < 3.30.03.30.0npm install rollup@3.30.0 -
>= 4.0.0, < 4.59.04.59.0npm install rollup@4.59.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using untrusted input for file names in Rollup configurations. Ensure that any input is properly validated and sanitized before being passed to the Rollup build process.
Conclusion
The Rollup module bundler has a critical vulnerability that allows arbitrary file writes due to improper sanitization and unsafe path resolution. It is crucial for users to update to the latest patched versions to protect their systems from potential attacks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for rollup →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Versions 4.x and earlier of Rollup are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Attackers can overwrite sensitive files, leading to system compromise, unauthorized access, and potential remote code execution.
If you cannot update immediately, ensure that you validate and sanitize any user input for file names to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for rollup.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
