CVE-2020-7684: Path Traversal in rollup-plugin-serve
Summary
CVE-2020-7684: Path traversal in rollup-plugin-serve. Affects rollup-plugin-serve versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
rollup-plugin-serve is an npm package used for serving Rollup bundles. It provides a development server that serves the bundled files. This package allows developers to easily test and preview their Rollup projects. However, versions prior to 1.0.2 are vulnerable to a path traversal vulnerability. This vulnerability occurs due to the lack of path sanitization in the readFile operation. An attacker can exploit this vulnerability to read arbitrary files from the server's filesystem.
Vulnerability Detail
The path traversal vulnerability in rollup-plugin-serve allows an attacker to access sensitive files on the server by manipulating the file path in the request. By exploiting this vulnerability, an attacker can read arbitrary files, including configuration files, source code, and other sensitive information. This can lead to unauthorized access, data leakage, and potential further attacks on the system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 3.0.0 as of 23 Oct 2026
npm install rollup-plugin-serve@3.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.2
This is the first release that contains the fix.
npm install rollup-plugin-serve@1.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of rollup-plugin-serve as soon as possible.
Conclusion
The path traversal vulnerability in rollup-plugin-serve can lead to unauthorized access and data leakage. It is crucial to update to version 1.0.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for rollup-plugin-serve →
FAQ
rollup-plugin-serve is an npm package used for serving Rollup bundles. It provides a development server that serves the bundled files.
Path traversal is a vulnerability that allows an attacker to access files outside of the intended directory. In this case, it allows an attacker to read arbitrary files from the server's filesystem.
By exploiting this vulnerability, an attacker can read sensitive files from the server, such as configuration files and source code. This can lead to unauthorized access, data leakage, and potential further attacks.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
To fix this vulnerability, update to version 1.0.2 or later of rollup-plugin-serve by running the command: npm install rollup-plugin-serve@1.0.2
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
