CVE-2026-27606Disclosure(rollupjs / rollup)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch rollupjs rollup systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.

rollupjs CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

rollup

Threat summary

Patch or workaround signal is available
7 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 6 signals
Disclosure: 5 classified signals
Peaked 3d ago at 3 mentions (2026-02-25); latest day: 1
7 total mentions across 4 days

Affected systems

Vendors

rollupjs

Products

rollup

Deep dive

Activity timeline7 mentions / 4d

Signal classification2 categories

Disclosure

571.4%

Patch

228.6%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-25	3	Disclosure3
2026-02-26	2	Disclosure1Patch1
2026-03-02	1	Disclosure1
2026-06-01	1	Patch1

Full discourse7 posts

CRAC Learning - Tech@cracbot220d
Disclosure
CVE-2026-27606 (CVSS:8.8, CRITICAL) is Analyzed. Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (sp..https://nvd.nist.gov/vuln/detail/CVE-2026-27606 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post references CVE-2026-27606, noting its critical CVSS score and affected Rollup versions, but does not mention PoC, exploit, active use, or patch.
1001029
173 followersView on X
MX3 Dev@Mx3Dev129d
Patch
@mem0ai Dependency hardening → Pinned jws to 4.0.1 (CVE-2025-65945) → Pinned tar-fs to ^2.1.4 (CVE-2025-48387, CVE-2025-59343) → Pinned @modelcontextprotocol/sdk to ^1.25.4 (CVE-2025-66414, CVE-2026-0621) → Pinned rollup to ^4.59.0 (CVE-2026-27606)
Post summary
The tweet records a security update effort, showing the team pinned specific dependencies to secure versions to mitigate several CVEs.
1000054
106 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds225d
Disclosure
CVE-2026-27606 Arbitrary File Write via Path Traversal in Rollup Module Bundler Versions Below 4.59.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27606
Post summary
The CVE describes an arbitrary file write vulnerability via path traversal in Rollup Module Bundler versions below 4.59.0, with no mention of PoC, exploit, or patch.
0001051
4.0K followersView on X
PulsePatch.io@pulsepatchio224d
Patch
Critical path traversal (DEBIAN-CVE-2026-27606) in `Rollup` <2.80.0,<3.30.0,<4.59.0 allows arbitrary file write, risking build compromise. Patching recommended. #JavaScript #Bundler #infosec https://www.pulsepatch.io/posts/debian-cve-2026-27606-rollup-arbitrary-file-write
Post summary
The post highlights a critical path traversal vulnerability in Rollup that permits arbitrary file writes, and it recommends applying patches to mitigate the risk.
0000048
1 followersView on X
cvereports@_cvereports225d
Disclosure
CVE-2026-27606: Bundling Disaster: The Rollup Path Traversal Deep Dive Rollup, the omnipresent JavaScript module bundler used by virtually every modern frontend framework, contained a critical flaw in how it handled output filenames. Due to a reliance... https://cvereports.com/reports/CVE-2026-27606
Post summary
The report highlights a path traversal vulnerability in Rollup’s filename handling, but does not provide PoC, exploit code, or patch details.
0000048
32 followersView on X
The Hacker Wire@TheHackerWire225d
Disclosure
🔴 CVE-2026-27606 - Critical Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an ... https://www.thehackerwire.com/vulnerability/CVE-2026-27606/ https://t.co/SLdqdp8pRs
Post summary
The post announces a critical vulnerability in Rollup module bundler affecting versions before 2.80.0, 3.30.0, and 4.59.0, with limited technical details provided.
0000060
115 followersView on X
CVE@CVEnew225d
Disclosure
CVE-2026-27606 Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source)… https://www.cve.org/CVERecord?id=CVE-2026-27606
Post summary
The text announces CVE-2026-27606 affecting Rollup module bundler versions prior to 2.80.0, 3.30.0, and 4.59.0, with a link to the CVE record.
00000125
56.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	rollupjs	rollup	-	node.js	-

Explore more

Back to dashboard rollupjs CVEs rollup vulnerabilities

What researchers are saying

CVE-2026-27606

MX3 Dev[verified]@Mx3DevPatch

The tweet records a security update effort, showing the team pinned specific dependencies to secure versions to mitigate several CVEs.

CRAC Learning - Tech@cracbotDisclosure

The post references CVE-2026-27606, noting its critical CVSS score and affected Rollup versions, but does not mention PoC, exploit, active use, or patch.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The CVE describes an arbitrary file write vulnerability via path traversal in Rollup Module Bundler versions below 4.59.0, with no mention of PoC, exploit, or patch.

PulsePatch.io@pulsepatchioPatch

The post highlights a critical path traversal vulnerability in Rollup that permits arbitrary file writes, and it recommends applying patches to mitigate the risk.

cvereports@_cvereportsDisclosure

The report highlights a path traversal vulnerability in Rollup’s filename handling, but does not provide PoC, exploit code, or patch details.

The Hacker Wire@TheHackerWireDisclosure

The post announces a critical vulnerability in Rollup module bundler affecting versions before 2.80.0, 3.30.0, and 4.59.0, with limited technical details provided.

CVE@CVEnewDisclosure

The text announces CVE-2026-27606 affecting Rollup module bundler versions prior to 2.80.0, 3.30.0, and 4.59.0, with a link to the CVE record.