VulnSocial

CVE-2024-47068Active Exploitation(rollupjs / rollup)

LOWCVSS 6.1 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for rollupjs rollup systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the vulnerability.

rollupjs CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • rollup

Threat summary

  • Active exploitation appears in 1 classified signals
  • 1 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
rollupjs
Products
rollup

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-08: 1Active Exploitation · 2026-09-08: 109-08
Signal classification1 categories
Active Exploitation
1100.0%
Referenced assets1 URL
Full discourse1 post
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    Attackers exploited CVE-2024-47068 in Elements software to fabricate unauthorized L-BTC tokens, then used legitimate peg-out mechanisms to drain $320M in real Bitcoin from Liquid Network reserves. TRC analysis shows how they established C2 via blockchain transactions and negotiated partial return through encrypted messages. #ZeroDay #ThreatIntel 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/liquid-network-elements-bug-exploit-2026-bitcoin-return

    Post summary

    Attackers used CVE‑2024‑47068 in Elements to mint fake L‑BTC tokens and channel them to liquidate $320M in Bitcoin via peg‑out, as documented in the linked threat analysis. No patch, exploit code, or PoC is provided, and the report focuses on confirmed active exploitation.

    0000055
    2.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Approllupjsrollup-node.js-

Explore more

Back to dashboardrollupjs CVEsrollup vulnerabilities