PT-2026-21834 · Rollup · Rollup

Viralvaghela · Published 2026-02-23 · Updated 2026-05-11 · CVE-2026-27606

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Rollup versions prior to 2.80.0 Rollup versions prior to 3.30.0 Rollup versions prior to 4.59.0

Description Rollup, a JavaScript module bundler, contains a flaw due to insecure file name sanitization in its core engine. This allows an attacker to manipulate output filenames using traversal sequences like ../ to overwrite files on the host filesystem where the build process has write access. This could lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. The issue is present in versions 4.x and earlier.

Recommendations Update to Rollup version 2.80.0 or later. Update to Rollup version 3.30.0 or later. Update to Rollup version 4.59.0 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-04349

CVE-2026-27606

GHSA-MW96-CPMX-2VGC

OPENSUSE-SU-2026:10263-1

RHSA-2026:13508

RHSA-2026:13512

SUSE-SU-2026:1013-1

SUSE-SU-2026:1148-1

SUSE-SU-2026:1524-1

Affected Products

Rollup

References · 104

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27606.json · Exploit
• https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e · Patch
• https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc · Vendor Advisory
• https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3 · Patch
• https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:1148-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27606 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04349 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-27606 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mw96-cpmx-2vgc · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27606 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1524-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-27606 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1013-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27606 · Vendor Advisory