DEBIAN-CVE-2026-27606

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-27606
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-27606.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-27606
Upstream
Published
2026-02-25T03:16:04.603Z
Modified
2026-03-16T17:00:10.811486Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.

References

Affected packages

Debian:11 / node-rollup

Package

Name
node-rollup
Purl
pkg:deb/debian/node-rollup?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.38.4-1
2.40.0-1
2.41.2-1
2.41.5-1
2.42.1-1
2.42.1-2
2.61.1-1
2.61.1-2
2.61.1-3
2.61.1-4
2.61.1-5
2.61.1-6
2.70.2-1
2.70.2-2
2.71.1-1
2.71.1-2
2.72.1-1
2.73.0-1
2.74.1-1
2.75.3-1
2.75.5-1
2.75.6-1
2.75.7-1
2.76.0-1
2.77.0-1
2.77.2-1
2.78.0-1
2.78.1-1
2.79.0-1
2.79.1-1
3.*
3.0.0~beta~8-1
3.2.3-1
3.2.5-1
3.2.5-2
3.3.0~beta~0-1
3.3.0-1
3.4.0-1
3.7.0-1
3.7.2-1
3.7.3-1
3.7.5-1
3.10.0-1
3.12.0-1
3.15.0-1
3.15.0-2
3.28.0-1
3.28.0-2
3.29.4-1
3.29.4-2
3.29.4-3
3.29.5-1
3.29.5-2
3.29.5-3
3.30.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-27606.json"

Debian:12 / node-rollup

Package

Name
node-rollup
Purl
pkg:deb/debian/node-rollup?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.15.0-1
3.15.0-1+deb12u1
3.15.0-2
3.28.0-1
3.28.0-2
3.29.4-1
3.29.4-2
3.29.4-3
3.29.5-1
3.29.5-2
3.29.5-3
3.30.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-27606.json"

Debian:13 / node-rollup

Package

Name
node-rollup
Purl
pkg:deb/debian/node-rollup?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.29.5-1
3.29.5-2
3.29.5-3
3.30.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-27606.json"

Debian:14 / node-rollup

Package

Name
node-rollup
Purl
pkg:deb/debian/node-rollup?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.30.0-1

Affected versions

3.*
3.29.5-1
3.29.5-2
3.29.5-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-27606.json"