Search: CVE-2026-27606

Rollup module bundler versions from 2.56.3 up to but not including 4.59.0 contain a vulnerability that allows arbitrary file write through path traversal. This occurs due to improper sanitization of output filenames, enabling attackers to write files outside the intended directory. The vulnerability can lead to overwriting arbitrary files with the permissions of the build process, potentially resulting in persistent remote code execution or supply chain compromise.