UBUNTU-CVE-2026-27606

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-27606
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-27606.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-27606
Upstream
Published
2026-02-25T03:16:00Z
Modified
2026-02-28T06:17:14.805786Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.

References

Affected packages

Ubuntu:20.04:LTS / node-rollup

Package

Name
node-rollup
Purl
pkg:deb/ubuntu/node-rollup@1.12.0-2build3?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.50.0-6build3
0.68.2-2
1.*
1.12.0-2build2
1.12.0-2build3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.12.0-2build3",
            "binary_name": "rollup"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-27606.json"

Ubuntu:22.04:LTS / node-rollup

Package

Name
node-rollup
Purl
pkg:deb/ubuntu/node-rollup@2.61.1-5?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.38.4-1
2.42.1-2
2.61.1-5

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.61.1-5",
            "binary_name": "rollup"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-27606.json"

Ubuntu:24.04:LTS / node-rollup

Package

Name
node-rollup
Purl
pkg:deb/ubuntu/node-rollup@3.29.4-3?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.28.0-2
3.29.4-2
3.29.4-3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "3.29.4-3",
            "binary_name": "rollup"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-27606.json"

Ubuntu:25.10 / node-rollup

Package

Name
node-rollup
Purl
pkg:deb/ubuntu/node-rollup@3.29.5-1?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.29.5-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "3.29.5-1",
            "binary_name": "rollup"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-27606.json"