Rollup 4 has Arbitrary File Write via Path Traversal (CVE-2026-27606)

The Rollup module bundler (versions >=2.56.3 <4.59.0) suffers from an arbitrary file write vulnerability due to improper sanitization of user-controlled output filenames and unsafe path resolution. The sanitizer regex excludes periods and slashes, allowing path traversal sequences to remain intact. When combined with path.resolve usage in the output writing function, this allows attackers to specify output filenames with '../' sequences that escape the designated output directory and overwrite arbitrary files on the host filesystem. This flaw can be exploited via CLI named inputs, manual chunk aliases, or malicious plugins. Proof-of-concept exploits demonstrate overwriting files outside the output directory, including sensitive system files if permissions allow.

This vulnerability enables attackers to write arbitrary files anywhere on the host filesystem accessible by the build process. This can lead to overwriting critical system or user configuration files such as SSH authorized keys or shell configuration files, potentially resulting in persistent remote code execution. It also poses a supply chain risk if exploited via malicious plugins or dependencies. The severity is high due to the potential for system compromise and persistence.

A patch is available for this vulnerability. Users should upgrade Rollup to version 4.59.0 or later where the issue is fixed. Until patched, avoid using untrusted input for output filenames or chunk aliases. Review and restrict build process permissions to minimize potential impact. No vendor advisory content contradicts these recommendations.