Threat Intelligence Database

A DOM Clobbering vulnerability (CVE-2024-47068) exists in rollup bundled scripts when using import.meta.url with output formats cjs, umd, or iife. This vulnerability allows an attacker to manipulate document.currentScript by injecting scriptless HTML elements with a name attribute of 'currentScript', leading to cross-site scripting (XSS) by loading attacker-controlled scripts. The issue arises because rollup replaces import.meta.url with a URL derived from document.currentScript without verifying the element's tag name. A patch is available that adds type checking to ensure the element is a SCRIPT tag before using its src attribute. The vulnerability affects rollup versions >=2.56.3 and <4.22.4 and has a CVSS 3.1 score of 6.4 (medium severity).

Rollup module bundler versions from 2.56.3 up to but not including 4.59.0 contain a vulnerability allowing arbitrary file write via path traversal. The issue arises from improper sanitization of output filenames, permitting path traversal sequences like '../' to bypass filters, combined with unsafe path resolution that writes files outside the intended output directory. This can enable attackers to overwrite arbitrary files on the host filesystem with the permissions of the build process, potentially leading to persistent remote code execution or supply chain compromise.