Rollup 4 has Arbitrary File Write via Path Traversal

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-27606 · CVE overview and exploitation status

EUVD-2026-8589

GHSA-mw96-cpmx-2vgc

cve-program · CVE-2026-27606

• https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc
• https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2
• https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e
• https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3
• https://github.com/rollup/rollup/releases/tag/v2.80.0
• https://github.com/rollup/rollup/releases/tag/v3.30.0
• https://github.com/rollup/rollup/releases/tag/v4.59.0

euvd · EUVD-2026-8589

• https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc
• https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2
• https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e
• https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3
• https://github.com/rollup/rollup/releases/tag/v2.80.0
• https://github.com/rollup/rollup/releases/tag/v3.30.0
• https://github.com/rollup/rollup/releases/tag/v4.59.0

nvd · CVE-2026-27606

• https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2
• https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e
• https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3
• https://github.com/rollup/rollup/releases/tag/v2.80.0
• https://github.com/rollup/rollup/releases/tag/v3.30.0
• https://github.com/rollup/rollup/releases/tag/v4.59.0
• https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc
• https://access.redhat.com/errata/RHSA-2026:10175
• https://access.redhat.com/errata/RHSA-2026:13508
• https://access.redhat.com/errata/RHSA-2026:13512
• https://access.redhat.com/errata/RHSA-2026:13545
• https://access.redhat.com/errata/RHSA-2026:5132
• https://access.redhat.com/errata/RHSA-2026:5649
• https://access.redhat.com/errata/RHSA-2026:5665
• https://access.redhat.com/errata/RHSA-2026:6174
• https://access.redhat.com/errata/RHSA-2026:6802
• https://access.redhat.com/errata/RHSA-2026:8483
• https://access.redhat.com/security/cve/CVE-2026-27606
• https://bugzilla.redhat.com/show_bug.cgi?id=2442530
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27606.json

osv · GHSA-mw96-cpmx-2vgc

• https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc
• https://nvd.nist.gov/vuln/detail/CVE-2026-27606
• https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2
• https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e
• https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3
• https://github.com/rollup/rollup
• https://github.com/rollup/rollup/releases/tag/v2.80.0
• https://github.com/rollup/rollup/releases/tag/v3.30.0
• https://github.com/rollup/rollup/releases/tag/v4.59.0

No related changes are available here.