DOM Clobbering Vulnerability in Rollup Leading to XSS
Summary
CVE-2024-47068: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS. Affects rollup across 3 version ranges.
< 2.79.2
>= 3.0.0, < 3.29.5
>= 4.0.0, < 4.22.4
Fixed in 2.79.2, 3.29.5 or 4.22.4, depending on the release line you run. How to fix ↓
Also tracked for
- node-rollup · Debian:11
The same CVE-2024-47068 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rollup is a popular JavaScript module bundler that compiles small pieces of code into larger, more complex applications. It is widely used for its ability to optimize and bundle JavaScript files efficiently, supporting various output formats such as CommonJS (cjs), Universal Module Definition (umd), and Immediately Invoked Function Expression (iife). However, a recent vulnerability has been identified that exposes applications using Rollup to potential cross-site scripting (XSS) attacks, particularly when scripts utilize 'import.meta.url'.
Vulnerability Detail
A DOM Clobbering vulnerability exists in Rollup when bundling scripts that reference 'import.meta.url' or use certain plugins. This vulnerability allows an attacker to manipulate the DOM by embedding non-script HTML elements, such as an 'img' tag with an unsanitized 'name' attribute. When the bundled script attempts to access 'document.currentScript', it can be redirected to the attacker's controlled element, leading to the execution of malicious scripts from an external server. This can result in significant security risks, including data theft and unauthorized actions on behalf of the user.
How To Fix
Latest published version: 4.65.0 as of 22 Oct 2026
npm install rollup@4.65.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.79.22.79.2npm install rollup@2.79.2 -
>= 3.0.0, < 3.29.53.29.5npm install rollup@3.29.5 -
>= 4.0.0, < 4.22.44.22.4npm install rollup@4.22.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using 'import.meta.url' in scripts bundled with Rollup, or ensure that user input is properly sanitized to prevent the injection of attacker-controlled HTML elements. For example, you can modify the script as follows:
const getRelativeUrlFromDocument = (relativePath) => {
return getResolveUrl(`'${escapeId(relativePath)}', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`);
};
Conclusion
The DOM Clobbering vulnerability in Rollup poses a significant risk for applications that utilize this bundler, particularly those that allow user-generated content. By updating to the latest versions and implementing proper input sanitization, developers can protect their applications from potential XSS attacks.
See every vulnerability recorded for rollup →
FAQ
DOM Clobbering is a type of attack where an attacker can manipulate the Document Object Model (DOM) to execute malicious scripts by embedding non-script HTML elements.
You can check if your application is affected by using Vulert, which monitors vulnerabilities in your package-lock.json file. Visit Vulert Scanner to use the Vulert playground without signup.
The vulnerability can lead to cross-site scripting (XSS) attacks, allowing attackers to steal sensitive information, manipulate user sessions, or perform actions on behalf of users.
Versions of Rollup prior to 3.29.5 for 0.x and prior to 4.22.4 for 4.x are affected by this vulnerability.
While the best solution is to update Rollup, you can mitigate the risk by sanitizing user inputs and avoiding the use of 'import.meta.url' in your scripts.
References
Related vulnerabilities
Recent vulnerabilities recorded for rollup.
